CVE-2020-16166

Опубликовано: 30 июл. 2020

Источник: nvd

CVSS3: 3.7

CVSS2: 4.3

EPSS Низкий

Описание

The Linux kernel through 5.7.11 allows remote attackers to make observations that help to obtain sensitive information about the internal state of the network RNG, aka CID-f227e3ec3b5c. This is related to drivers/char/random.c and kernel/time/timer.c.

Ссылки

http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00009.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00047.html
Mailing List
Third Party Advisory
https://arxiv.org/pdf/2012.07432.pdf
Technical Description
Third Party Advisory
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f227e3ec3b5cad859ad15666874405e8c1bbc1d4
Patch
Vendor Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c51f8f88d705e06bd696d7510aff22b33eb8e638
Patch
Vendor Advisory
https://github.com/torvalds/linux/commit/f227e3ec3b5cad859ad15666874405e8c1bbc1d4
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/09/msg00025.html
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/10/msg00032.html
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/10/msg00034.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AAPTLPAEKVAJYJ4LHN7VH4CN2W75R2YW/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MFBCLQWJI5I4G25TVJNLXLAXJ4MERQNW/
https://security.netapp.com/advisory/ntap-20200814-0004/
Third Party Advisory
https://usn.ubuntu.com/4525-1/
Third Party Advisory
https://usn.ubuntu.com/4526-1/
Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html
Patch
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00009.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00047.html
Mailing List
Third Party Advisory
https://arxiv.org/pdf/2012.07432.pdf
Technical Description
Third Party Advisory
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f227e3ec3b5cad859ad15666874405e8c1bbc1d4
Patch
Vendor Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c51f8f88d705e06bd696d7510aff22b33eb8e638
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия до 5.7.11 (включая)

Конфигурация 2

Одно из

cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*

Конфигурация 4

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Конфигурация 5

Одно из

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*

Конфигурация 6

Одно из

cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:*

Версия от 9.5 (включая)

cpe:2.3:a:netapp:cloud_volumes_ontap_mediator:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*

Версия от 11.0.0 (включая) до 11.60.3 (включая)

cpe:2.3:a:netapp:hci_bootstrap_os:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:storagegrid:*:*:*:*:*:*:*:*

Версия до 9.0.4 (включая)

Конфигурация 7

Одновременно

cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*

Конфигурация 8

cpe:2.3:a:oracle:sd-wan_edge:8.2:*:*:*:*:*:*:*

EPSS

Процентиль: 82%

0.01848

Низкий

3.7 Low

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-330

Связанные уязвимости

CVE-2020-16166

CVSS3: 3.7

ubuntu

почти 5 лет назад

CVE-2020-16166

CVSS3: 3.7

redhat

почти 5 лет назад

CVE-2020-16166

CVSS3: 3.7

msrc

почти 5 лет назад

Описание отсутствует

CVE-2020-16166

CVSS3: 3.7

debian

почти 5 лет назад

The Linux kernel through 5.7.11 allows remote attackers to make observ ...

GHSA-6c68-84gq-j9gr

CVSS3: 3.7

github

около 3 лет назад

EPSS

Процентиль: 82%

0.01848

Низкий

3.7 Low

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-330