CVE-2020-16166
moderate-risk
Published 2020-07-30
The Linux kernel through 5.7.11 allows remote attackers to make observations that help to obtain sensitive information about the internal state of the network RNG, aka CID-f227e3ec3b5c. This is related to drivers/char/random.c and kernel/time/timer.c.
Do I need to act?
~
1.7% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
3
CVSS 3.7/10
Low
NETWORK
/ HIGH complexity
Affected Products (20)
Cloud Volumes Ontap Mediator
References (30)
Technical Description
https://arxiv.org/pdf/2012.07432.pdf
Third Party Advisory
https://security.netapp.com/advisory/ntap-20200814-0004/
Third Party Advisory
https://usn.ubuntu.com/4525-1/
Third Party Advisory
https://usn.ubuntu.com/4526-1/
Technical Description
https://arxiv.org/pdf/2012.07432.pdf
and 10 more references
37
/ 100
moderate-risk
Severity
13/34 · Low
Exploitability
4/34 · Minimal
Exposure
20/34 · Moderate