CVE-2016-10147

What it actually does

Local NULL pointer dereference in crypto/mcryptd.c triggered when an AF_ALG socket is bound to an incompatible algorithm such as mcryptd(md5), resulting in immediate kernel panic.

Why it matters to the business

A local user can crash the entire system at will, interrupting all services and workloads running on that host; the flaw has been public for nearly a decade with negligible exploitation activity and no ransomware usage.

How an attack unfolds

An attacker who already possesses a local shell on a vulnerable Linux kernel creates an AF_ALG socket, selects the mcryptd algorithm with an incompatible digest (md5), and triggers the NULL dereference path inside mcryptd.c, causing an immediate kernel crash.

How to fix it

Upgrade the Linux kernel to a version containing commit 48a992727d82cb7db076fa15d372178743b1f4cd (equivalent to 4.8.15 or later mainline) and reboot the affected hosts.

How to confirm the fix worked

Verify the running kernel is 4.8.15 or newer; attempt to reproduce the crash with a minimal AF_ALG test program on a non-production system to confirm the defect is absent.

Typical attack path

1. Obtain local shell access on the target system
2. Load or confirm presence of the mcryptd crypto module
3. Invoke socket(AF_ALG, SOCK_SEQPACKET, 0) followed by bind() with an incompatible algorithm name
4. Trigger the dereference to crash the kernel

How to detect it

Inspect kernel logs (dmesg, /var/log/kern.log, journalctl) for NULL pointer dereference crashes originating from mcryptd.c or crypto code paths; correlate with user processes that recently created AF_ALG sockets.

• mcryptd(md5)
• NULL pointer dereference in mcryptd
• crypto/mcryptd.c

What your security team should do

• Patch to a fixed kernel version at the next maintenance window
• Restrict local user accounts that can create AF_ALG sockets via LSM or seccomp filters where patching is delayed
• Monitor for kernel oops/panic logs containing mcryptd references