Junglewise Threat Intelligence

CVE-2016-10147: Linux Kernel NULL pointer dereference in crypto mcryptd

CVE-2016-10147 · Severity: medium · CVSS 5.5 · Published 2017-01-18

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's cryptographic subsystem could allow a local user to crash the entire system. By requesting a specific type of cryptographic operation that is incompatible with the system's internal handlers, an attacker can trigger a system-wide denial of service. This could lead to unplanned downtime and loss of availability for services running on the affected machine.

Technical details

A NULL pointer dereference vulnerability exists in `crypto/mcryptd.c` in the Linux kernel before 4.8.15. The issue stems from the `mcryptd` component failing to verify algorithm compatibility when spawning new cryptographic transformations via `crypto_alloc_tfm`. A local attacker can exploit this by using an `AF_ALG` socket to request an incompatible algorithm (e.g., `mcryptd(md5)`), which triggers a NULL pointer dereference and subsequent kernel panic. The fix introduces a check to ensure only internal, compatible algorithms are allowed to be spawned by `mcryptd`.

Affected products

  • Linux Linux Kernel before 4.8.15

Timeline

  • 2016-12-02: disclosed: Vulnerability reported on the linux-crypto mailing list
  • 2016-12-15: patched: Fixed in Linux kernel version 4.8.15
  • 2017-01-18: advisory: NVD publication date

References

Related threats