CVE-2024-43852

What it actually does

Off-by-one condition ordering allows channel index equal to LTC2991_T_INT_CH_NR to be used as an array index into a 4-element temp_en[] buffer, resulting in an out-of-bounds read.

Why it matters to the business

Local users on widely deployed Linux systems can trigger kernel memory corruption, leading to crashes, information disclosure, or privilege escalation; 83k+ downstream dependents increase exposure surface.

How an attack unfolds

An attacker with local access loads or interacts with the ltc2991 hwmon driver, supplies a channel value of 4, and the reversed bounds check permits reading past the end of the temperature-enable array, enabling further memory corruption or info leak.

How to fix it

Update the Linux kernel to commit c180311c0a520692e2d0e9ca44dcd6c2ff1b41c4 or later stable releases containing the reordered condition check; rebuild and reboot affected systems.

How to confirm the fix worked

Verify the fixed commit is present in the running kernel source, confirm ltc2991 driver initialization succeeds without oops, and run regression tests exercising all four temperature channels.

Typical attack path

1. Obtain local shell on target Linux system
2. Trigger ltc2991 temperature channel access with index 4
3. Bypass bounds check due to condition order
4. Perform out-of-bounds read to corrupt or leak kernel memory
5. Escalate privileges or cause denial of service

How to detect it

Search kernel logs for ltc2991 driver oops or array bounds warnings, monitor hwmon sysfs accesses around temperature channels, and review audit logs for unusual local process behavior targeting sensor devices.

What your security team should do

• Prioritize kernel updates on systems exposing hwmon sensors
• Restrict unprivileged local access until patched
• Monitor for kernel oops or hwmon-related panics in logs
• Track EPSS and downstream adoption metrics for reprioritization