CVE-2024-38587: speakup: Fix sizeof() vs ARRAY_SIZE() bug
In the Linux kernel, the following vulnerability has been resolved:
speakup: Fix sizeof() vs ARRAYSIZE() bug
The "buf" pointer is an array of u16 values. This code should be using ARRAYSIZE() (which is 256) instead of sizeof() (which is 512), otherwise it can the still got out of bounds.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.94-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.8.12-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Compensating control
Verify the speakup code uses ARRAY_SIZE() (256) instead of sizeof() (512) for the u16 buf array to prevent out-of-bounds access.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-38587?
CVE-2024-38587 is classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2024-38587?
To fix CVE-2024-38587, update your Linux kernel to version 5.10.223-1, 5.10.226-1, 6.1.119-1, 6.1.123-1, 6.12.10-1, or 6.12.11-1.
What software is affected by CVE-2024-38587?
CVE-2024-38587 affects specific versions of the Linux package in the Debian distribution.
What causes CVE-2024-38587?
CVE-2024-38587 is caused by a bug in the speakup driver where sizeof() is incorrectly used instead of ARRAY_SIZE().
Is there a workaround for CVE-2024-38587?
Currently, the recommended course of action for CVE-2024-38587 is to apply the available kernel updates rather than trying to implement a workaround.