CVE-2024-38587 (GCVE-0-2024-38587)
Vulnerability from cvelistv5
Published
2024-06-19 13:37
Modified
2026-08-05 11:33
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: speakup: Fix sizeof() vs ARRAY_SIZE() bug The "buf" pointer is an array of u16 values. This code should be using ARRAY_SIZE() (which is 256) instead of sizeof() (which is 512), otherwise it can the still got out of bounds.
References
Impacted products
Vendor Product Version
Linux Linux Version: 756c5cb7c09e537b87b5d3acafcb101b2ccf394f
Version: 8f6b62125befe1675446923e4171eac2c012959c
Version: 6401038acfa24cba9c28cce410b7505efadd0222
Version: 0d130158db29f5e0b3893154908cf618896450a8
Version: 89af25bd4b4bf6a71295f07e07a8ae7dc03c6595
Version: 8defb1d22ba0395b81feb963b96e252b097ba76f
Version: 0efb15c14c493263cb3a5f65f5ddfd4603d19a76
Version: c8d2f34ea96ea3bce6ba2535f867f0d4ee3b22e1
Version: c8d2f34ea96ea3bce6ba2535f867f0d4ee3b22e1
Version: 4.19.313   ≤
Version: 5.4.275   ≤
Version: 5.10.216   ≤
Version: 5.15.157   ≤
Version: 6.1.88   ≤
Version: 6.6.29   ≤
Version: 6.8.8   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-38587",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-20T14:49:14.118323Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-04T20:21:08.889Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:21:38.044Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/42f0a3f67158ed6b2908d2b9ffbf7e96d23fd358"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/cd7f3978c2ec741aedd1d860b2adb227314cf996"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/07ef95cc7a579731198c93beed281e3a79a0e586"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/504178fb7d9f6cdb0496d5491efb05f45597e535"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3726f75a1ccc16cd335c0ccfad1d92ee08ecba5e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c6e1650cf5df1bd6638eeee231a683ef30c7d4eb"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/eb1ea64328d4cc7d7a912c563f8523d5259716ef"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d52c04474feac8e305814a5228e622afe481b2ef"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/008ab3c53bc4f0b2f20013c8f6c204a3203d0b8b"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCM-/XRM-/XCH-/XRH-300 family",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T11:54:45.936Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-613116.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/accessibility/speakup/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "42f0a3f67158ed6b2908d2b9ffbf7e96d23fd358",
              "status": "affected",
              "version": "756c5cb7c09e537b87b5d3acafcb101b2ccf394f",
              "versionType": "git"
            },
            {
              "lessThan": "cd7f3978c2ec741aedd1d860b2adb227314cf996",
              "status": "affected",
              "version": "8f6b62125befe1675446923e4171eac2c012959c",
              "versionType": "git"
            },
            {
              "lessThan": "07ef95cc7a579731198c93beed281e3a79a0e586",
              "status": "affected",
              "version": "6401038acfa24cba9c28cce410b7505efadd0222",
              "versionType": "git"
            },
            {
              "lessThan": "504178fb7d9f6cdb0496d5491efb05f45597e535",
              "status": "affected",
              "version": "0d130158db29f5e0b3893154908cf618896450a8",
              "versionType": "git"
            },
            {
              "lessThan": "3726f75a1ccc16cd335c0ccfad1d92ee08ecba5e",
              "status": "affected",
              "version": "89af25bd4b4bf6a71295f07e07a8ae7dc03c6595",
              "versionType": "git"
            },
            {
              "lessThan": "c6e1650cf5df1bd6638eeee231a683ef30c7d4eb",
              "status": "affected",
              "version": "8defb1d22ba0395b81feb963b96e252b097ba76f",
              "versionType": "git"
            },
            {
              "lessThan": "eb1ea64328d4cc7d7a912c563f8523d5259716ef",
              "status": "affected",
              "version": "0efb15c14c493263cb3a5f65f5ddfd4603d19a76",
              "versionType": "git"
            },
            {
              "lessThan": "d52c04474feac8e305814a5228e622afe481b2ef",
              "status": "affected",
              "version": "c8d2f34ea96ea3bce6ba2535f867f0d4ee3b22e1",
              "versionType": "git"
            },
            {
              "lessThan": "008ab3c53bc4f0b2f20013c8f6c204a3203d0b8b",
              "status": "affected",
              "version": "c8d2f34ea96ea3bce6ba2535f867f0d4ee3b22e1",
              "versionType": "git"
            },
            {
              "lessThan": "4.19.316",
              "status": "affected",
              "version": "4.19.313",
              "versionType": "semver"
            },
            {
              "lessThan": "5.4.278",
              "status": "affected",
              "version": "5.4.275",
              "versionType": "semver"
            },
            {
              "lessThan": "5.10.219",
              "status": "affected",
              "version": "5.10.216",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.161",
              "status": "affected",
              "version": "5.15.157",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.93",
              "status": "affected",
              "version": "6.1.88",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.33",
              "status": "affected",
              "version": "6.6.29",
              "versionType": "semver"
            },
            {
              "lessThan": "6.8.12",
              "status": "affected",
              "version": "6.8.8",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/accessibility/speakup/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.316",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.278",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.219",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.161",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.316",
                  "versionStartIncluding": "4.19.313",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.278",
                  "versionStartIncluding": "5.4.275",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.219",
                  "versionStartIncluding": "5.10.216",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.161",
                  "versionStartIncluding": "5.15.157",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.93",
                  "versionStartIncluding": "6.1.88",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.33",
                  "versionStartIncluding": "6.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.12",
                  "versionStartIncluding": "6.8.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.3",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspeakup: Fix sizeof() vs ARRAY_SIZE() bug\n\nThe \"buf\" pointer is an array of u16 values.  This code should be\nusing ARRAY_SIZE() (which is 256) instead of sizeof() (which is 512),\notherwise it can the still got out of bounds."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached only through the local virtual console \u2014 writing screen content to an owned VC, resizing it via VT_RESIZE, and a speakup KT_SPKUP keypress delivered through the keyboard notifier; there is no network or remote-peer input involved. CVSS 3.1 AV:L covers attacks performed by a local user of the system, including those relying on a console-local action.\nAC:L - Every precondition is under the attacker\u0027s control: the tty owner can set vc_cols\u003e257 himself via VT_RESIZE (vgacon accepts any from_user width fitting VRAM), write the \u2265257-character word with echo, place the reading cursor, and press the say-word key \u2014 a deterministic, repeatable overflow with no race and no memory-layout guessing.\nPR:L - Only an unprivileged local account with a virtual-console session is needed; VT_RESIZE and PIO_UNIMAP are granted to the tty owner without CAP_SYS_TTY_CONFIG (drivers/tty/vt/vt_ioctl.c:740), and writing to one\u0027s own /dev/ttyN requires no capability.\nUI:N - The attacker performs every step in his own console session \u2014 resize, print the long word, press the speakup key \u2014 so no second user has to be tricked into any action.\nS:U - The out-of-bounds write corrupts kernel .bss belonging to the speakup module, staying entirely within the kernel\u0027s own security authority with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - Overwriting adjacent pointer globals such as spk_characters[], spk_our_keys[], or the i18n message pointers with attacker-chosen 64-bit values turns speakup into an arbitrary kernel-memory read whose output is spoken out and readable from /dev/softsynth; the companion OOB read in spkup_write(buf, 512) also exposes adjacent kernel data.\nI:H - This is a 512-byte out-of-bounds write of fully attacker-chosen u16 values (arbitrary Unicode via a custom unimap) into a cluster of kernel pointers, including the spk_special_handler function pointer that is invoked directly on the next keypress \u2014 a direct control-flow hijack and arbitrary-write primitive.\nA:H - Corrupting neighbouring pointers such as tty, speakup_task, or speakup_console[] with garbage reliably produces an oops or panic even without a weaponized exploit, and the write can be repeated at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:33:00.055Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/42f0a3f67158ed6b2908d2b9ffbf7e96d23fd358"
        },
        {
          "url": "https://git.kernel.org/stable/c/cd7f3978c2ec741aedd1d860b2adb227314cf996"
        },
        {
          "url": "https://git.kernel.org/stable/c/07ef95cc7a579731198c93beed281e3a79a0e586"
        },
        {
          "url": "https://git.kernel.org/stable/c/504178fb7d9f6cdb0496d5491efb05f45597e535"
        },
        {
          "url": "https://git.kernel.org/stable/c/3726f75a1ccc16cd335c0ccfad1d92ee08ecba5e"
        },
        {
          "url": "https://git.kernel.org/stable/c/c6e1650cf5df1bd6638eeee231a683ef30c7d4eb"
        },
        {
          "url": "https://git.kernel.org/stable/c/eb1ea64328d4cc7d7a912c563f8523d5259716ef"
        },
        {
          "url": "https://git.kernel.org/stable/c/d52c04474feac8e305814a5228e622afe481b2ef"
        },
        {
          "url": "https://git.kernel.org/stable/c/008ab3c53bc4f0b2f20013c8f6c204a3203d0b8b"
        }
      ],
      "title": "speakup: Fix sizeof() vs ARRAY_SIZE() bug",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-38587",
    "datePublished": "2024-06-19T13:37:42.537Z",
    "dateReserved": "2024-06-18T19:36:34.929Z",
    "dateUpdated": "2026-08-05T11:33:00.055Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/42f0a3f67158ed6b2908d2b9ffbf7e96d23fd358\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/cd7f3978c2ec741aedd1d860b2adb227314cf996\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/07ef95cc7a579731198c93beed281e3a79a0e586\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/504178fb7d9f6cdb0496d5491efb05f45597e535\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/3726f75a1ccc16cd335c0ccfad1d92ee08ecba5e\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/c6e1650cf5df1bd6638eeee231a683ef30c7d4eb\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/eb1ea64328d4cc7d7a912c563f8523d5259716ef\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d52c04474feac8e305814a5228e622afe481b2ef\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/008ab3c53bc4f0b2f20013c8f6c204a3203d0b8b\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-04T17:21:38.044Z\"}}, {\"affected\": [{\"vendor\": \"Siemens\", \"product\": \"RUGGEDCOM RST2428P\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V3.1\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SCALANCE XCM-/XRM-/XCH-/XRH-300 family\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V3.1\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"x_adpType\": \"supplier\", \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-265688.html\"}, {\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-613116.html\"}], \"providerMetadata\": {\"orgId\": \"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\", \"shortName\": \"siemens-SADP\", \"dateUpdated\": \"2026-05-12T11:54:45.936Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-38587\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-20T14:49:14.118323Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"CWE-noinfo Not enough information\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-20T14:49:19.666Z\"}}], \"cna\": {\"title\": \"speakup: Fix sizeof() vs ARRAY_SIZE() bug\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable path is reached only through the local virtual console \\u2014 writing screen content to an owned VC, resizing it via VT_RESIZE, and a speakup KT_SPKUP keypress delivered through the keyboard notifier; there is no network or remote-peer input involved. CVSS 3.1 AV:L covers attacks performed by a local user of the system, including those relying on a console-local action.\\nAC:L - Every precondition is under the attacker\u0027s control: the tty owner can set vc_cols\u003e257 himself via VT_RESIZE (vgacon accepts any from_user width fitting VRAM), write the \\u2265257-character word with echo, place the reading cursor, and press the say-word key \\u2014 a deterministic, repeatable overflow with no race and no memory-layout guessing.\\nPR:L - Only an unprivileged local account with a virtual-console session is needed; VT_RESIZE and PIO_UNIMAP are granted to the tty owner without CAP_SYS_TTY_CONFIG (drivers/tty/vt/vt_ioctl.c:740), and writing to one\u0027s own /dev/ttyN requires no capability.\\nUI:N - The attacker performs every step in his own console session \\u2014 resize, print the long word, press the speakup key \\u2014 so no second user has to be tricked into any action.\\nS:U - The out-of-bounds write corrupts kernel .bss belonging to the speakup module, staying entirely within the kernel\u0027s own security authority with no crossing of a VM, IOMMU, or sandbox boundary.\\nC:H - Overwriting adjacent pointer globals such as spk_characters[], spk_our_keys[], or the i18n message pointers with attacker-chosen 64-bit values turns speakup into an arbitrary kernel-memory read whose output is spoken out and readable from /dev/softsynth; the companion OOB read in spkup_write(buf, 512) also exposes adjacent kernel data.\\nI:H - This is a 512-byte out-of-bounds write of fully attacker-chosen u16 values (arbitrary Unicode via a custom unimap) into a cluster of kernel pointers, including the spk_special_handler function pointer that is invoked directly on the next keypress \\u2014 a direct control-flow hijack and arbitrary-write primitive.\\nA:H - Corrupting neighbouring pointers such as tty, speakup_task, or speakup_console[] with garbage reliably produces an oops or panic even without a weaponized exploit, and the write can be repeated at will.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"756c5cb7c09e537b87b5d3acafcb101b2ccf394f\", \"lessThan\": \"42f0a3f67158ed6b2908d2b9ffbf7e96d23fd358\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8f6b62125befe1675446923e4171eac2c012959c\", \"lessThan\": \"cd7f3978c2ec741aedd1d860b2adb227314cf996\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6401038acfa24cba9c28cce410b7505efadd0222\", \"lessThan\": \"07ef95cc7a579731198c93beed281e3a79a0e586\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0d130158db29f5e0b3893154908cf618896450a8\", \"lessThan\": \"504178fb7d9f6cdb0496d5491efb05f45597e535\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"89af25bd4b4bf6a71295f07e07a8ae7dc03c6595\", \"lessThan\": \"3726f75a1ccc16cd335c0ccfad1d92ee08ecba5e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8defb1d22ba0395b81feb963b96e252b097ba76f\", \"lessThan\": \"c6e1650cf5df1bd6638eeee231a683ef30c7d4eb\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0efb15c14c493263cb3a5f65f5ddfd4603d19a76\", \"lessThan\": \"eb1ea64328d4cc7d7a912c563f8523d5259716ef\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c8d2f34ea96ea3bce6ba2535f867f0d4ee3b22e1\", \"lessThan\": \"d52c04474feac8e305814a5228e622afe481b2ef\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c8d2f34ea96ea3bce6ba2535f867f0d4ee3b22e1\", \"lessThan\": \"008ab3c53bc4f0b2f20013c8f6c204a3203d0b8b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4.19.313\", \"lessThan\": \"4.19.316\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.4.275\", \"lessThan\": \"5.4.278\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.10.216\", \"lessThan\": \"5.10.219\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.15.157\", \"lessThan\": \"5.15.161\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.1.88\", \"lessThan\": \"6.1.93\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.6.29\", \"lessThan\": \"6.6.33\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.8.8\", \"lessThan\": \"6.8.12\", \"versionType\": \"semver\"}], \"programFiles\": [\"drivers/accessibility/speakup/main.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.9\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.9\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.316\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.278\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.219\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.161\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.93\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.33\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.12\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/accessibility/speakup/main.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/42f0a3f67158ed6b2908d2b9ffbf7e96d23fd358\"}, {\"url\": \"https://git.kernel.org/stable/c/cd7f3978c2ec741aedd1d860b2adb227314cf996\"}, {\"url\": \"https://git.kernel.org/stable/c/07ef95cc7a579731198c93beed281e3a79a0e586\"}, {\"url\": \"https://git.kernel.org/stable/c/504178fb7d9f6cdb0496d5491efb05f45597e535\"}, {\"url\": \"https://git.kernel.org/stable/c/3726f75a1ccc16cd335c0ccfad1d92ee08ecba5e\"}, {\"url\": \"https://git.kernel.org/stable/c/c6e1650cf5df1bd6638eeee231a683ef30c7d4eb\"}, {\"url\": \"https://git.kernel.org/stable/c/eb1ea64328d4cc7d7a912c563f8523d5259716ef\"}, {\"url\": \"https://git.kernel.org/stable/c/d52c04474feac8e305814a5228e622afe481b2ef\"}, {\"url\": \"https://git.kernel.org/stable/c/008ab3c53bc4f0b2f20013c8f6c204a3203d0b8b\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nspeakup: Fix sizeof() vs ARRAY_SIZE() bug\\n\\nThe \\\"buf\\\" pointer is an array of u16 values.  This code should be\\nusing ARRAY_SIZE() (which is 256) instead of sizeof() (which is 512),\\notherwise it can the still got out of bounds.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.316\", \"versionStartIncluding\": \"4.19.313\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.278\", \"versionStartIncluding\": \"5.4.275\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.219\", \"versionStartIncluding\": \"5.10.216\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.161\", \"versionStartIncluding\": \"5.15.157\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.93\", \"versionStartIncluding\": \"6.1.88\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.33\", \"versionStartIncluding\": \"6.6.29\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.12\", \"versionStartIncluding\": \"6.8.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.3\", \"versionStartIncluding\": \"6.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"6.9\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:33:00.055Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-38587\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:33:00.055Z\", \"dateReserved\": \"2024-06-18T19:36:34.929Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-06-19T13:37:42.537Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.