Low severity · published Jul 30, 2020
CVE-2020-16166
The Linux kernel through 5.7.11 allows remote attackers to make observations that help to obtain sensitive information about the internal state of the network RNG, aka…
3.7
CVSS
5.2%
EPSS
No
On KEV
Description
The Linux kernel through 5.7.11 allows remote attackers to make observations that help to obtain sensitive information about the internal state of the network RNG, aka CID-f227e3ec3b5c. This is related to drivers/char/random.c and kernel/time/timer.c.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)5.2% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KE
Kernel · Linux
through 5.7.11 · source: NVD
AI
Active IQ Unified Manager · Netapp
9.5 and later · source: NVD
CV
Cloud Volumes Ontap Mediator · Netapp
All versions, or not specified · source: NVD
DL
Debian Linux · Debian
9.0 · source: NVD
ES
E-series Santricity OS Controller · Netapp
11.0.0 through 11.60.3 · source: NVD
FE
Fedora · Fedoraproject
31; 32 · source: NVD
HF
H410c Firmware · Netapp
All versions, or not specified · source: NVD
HB
Hci Bootstrap OS · Netapp
All versions, or not specified · source: NVD
HM
Hci Management Node · Netapp
All versions, or not specified · source: NVD
LE
Leap · Opensuse
15.1; 15.2 · source: NVD
SE
Sd-wan Edge · Oracle
8.2 · source: NVD
SO
Solidfire · Netapp
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-16166
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-16166
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00009.html
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00047.html
Technical Description
https://arxiv.org/pdf/2012.07432.pdf
Patch
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f227e3ec3b5cad859ad15666874405e8c1bbc1d4
Patch
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c51f8f88d705e06bd696d7510aff22b33eb8e638
Patch
https://github.com/torvalds/linux/commit/f227e3ec3b5cad859ad15666874405e8c1bbc1d4
More from Kernel
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
8.8
CVE-2013-6282
Linux Kernel Improper Input Validation Vulnerability
8.4
CVE-2022-0185
Linux Kernel Heap-Based Buffer Overflow Vulnerability
8.4
CVE-2013-2094
Linux Kernel Privilege Escalation Vulnerability