CVE-2021-46940

What it actually does

Integer signedness issue in turbostat's idx_to_offset() and offset_to_idx() causes u32 MSR values like MSR_PKG_ENERGY_STAT to be treated as negative offsets, triggering the (offset < 0) guard in update_msr_sum() and disabling background timer-based MSR sampling for long collection intervals.

Why it matters to the business

Linux systems relying on turbostat for long-duration power and energy monitoring experience silent gaps in statistics collection, impairing capacity planning, thermal management, and compliance reporting.

How an attack unfolds

A local user starts turbostat with extended sampling intervals; the type mismatch in index conversion produces a negative offset that aborts MSR updates in the timer callback, resulting in incomplete energy accounting without further attacker interaction.

How to fix it

Apply the upstream kernel patch that changes the affected functions to use off_t instead of int; rebuild and deploy the turbostat binary or update to a kernel release containing commit fixing the offset conversion.

How to confirm the fix worked

Inspect turbostat source for idx_to_offset/offset_to_idx signatures returning off_t, recompile, and confirm that long-interval runs no longer produce negative-offset skips in update_msr_sum() logs or strace output.

Typical attack path

1. Obtain local user access on an affected Linux system
2. Invoke turbostat with long-duration or background collection options
3. Trigger repeated calls to idx_to_offset() or offset_to_idx() on large u32 MSR values
4. Observe update_msr_sum() skipping updates due to negative offset check

How to detect it

Search turbostat logs, systemd journal entries, or process output for repeated negative offset warnings or missing MSR_PKG_ENERGY_STAT updates during extended collection windows; correlate with process start times and interval parameters.

What your security team should do

• Inventory systems running turbostat and schedule kernel updates containing the off_t fix
• Add turbostat collection failures to monitoring dashboards to detect incomplete sampling
• Review any custom power-reporting scripts that depend on turbostat output for accuracy