CVE-2024-38587

{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2024-38587", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-06-18T19:36:34.929Z", "datePublished": "2024-06-19T13:37:42.537Z", "dateUpdated": "2026-10-15T00:43:31.450Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:33:00.055Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspeakup: Fix sizeof() vs ARRAY_SIZE() bug\n\nThe \"buf\" pointer is an array of u16 values. This code should be\nusing ARRAY_SIZE() (which is 256) instead of sizeof() (which is 512),\notherwise it can the still got out of bounds."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is reached only through the local virtual console \u2014 writing screen content to an owned VC, resizing it via VT_RESIZE, and a speakup KT_SPKUP keypress delivered through the keyboard notifier; there is no network or remote-peer input involved. CVSS 3.1 AV:L covers attacks performed by a local user of the system, including those relying on a console-local action.\nAC:L - Every precondition is under the attacker's control: the tty owner can set vc_cols>257 himself via VT_RESIZE (vgacon accepts any from_user width fitting VRAM), write the \u2265257-character word with echo, place the reading cursor, and press the say-word key \u2014 a deterministic, repeatable overflow with no race and no memory-layout guessing.\nPR:L - Only an unprivileged local account with a virtual-console session is needed; VT_RESIZE and PIO_UNIMAP are granted to the tty owner without CAP_SYS_TTY_CONFIG (drivers/tty/vt/vt_ioctl.c:740), and writing to one's own /dev/ttyN requires no capability.\nUI:N - The attacker performs every step in his own console session \u2014 resize, print the long word, press the speakup key \u2014 so no second user has to be tricked into any action.\nS:U - The out-of-bounds write corrupts kernel .bss belonging to the speakup module, staying entirely within the kernel's own security authority with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - Overwriting adjacent pointer globals such as spk_characters[], spk_our_keys[], or the i18n message pointers with attacker-chosen 64-bit values turns speakup into an arbitrary kernel-memory read whose output is spoken out and readable from /dev/softsynth; the companion OOB read in spkup_write(buf, 512) also exposes adjacent kernel data.\nI:H - This is a 512-byte out-of-bounds write of fully attacker-chosen u16 values (arbitrary Unicode via a custom unimap) into a cluster of kernel pointers, including the spk_special_handler function pointer that is invoked directly on the next keypress \u2014 a direct control-flow hijack and arbitrary-write primitive.\nA:H - Corrupting neighbouring pointers such as tty, speakup_task, or speakup_console[] with garbage reliably produces an oops or panic even without a weaponized exploit, and the write can be repeated at will."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/accessibility/speakup/main.c"], "versions": [{"version": "756c5cb7c09e537b87b5d3acafcb101b2ccf394f", "lessThan": "42f0a3f67158ed6b2908d2b9ffbf7e96d23fd358", "status": "affected", "versionType": "git"}, {"version": "8f6b62125befe1675446923e4171eac2c012959c", "lessThan": "cd7f3978c2ec741aedd1d860b2adb227314cf996", "status": "affected", "versionType": "git"}, {"version": "6401038acfa24cba9c28cce410b7505efadd0222", "lessThan": "07ef95cc7a579731198c93beed281e3a79a0e586", "status": "affected", "versionType": "git"}, {"version": "0d130158db29f5e0b3893154908cf618896450a8", "lessThan": "504178fb7d9f6cdb0496d5491efb05f45597e535", "status": "affected", "versionType": "git"}, {"version": "89af25bd4b4bf6a71295f07e07a8ae7dc03c6595", "lessThan": "3726f75a1ccc16cd335c0ccfad1d92ee08ecba5e", "status": "affected", "versionType": "git"}, {"version": "8defb1d22ba0395b81feb963b96e252b097ba76f", "lessThan": "c6e1650cf5df1bd6638eeee231a683ef30c7d4eb", "status": "affected", "versionType": "git"}, {"version": "0efb15c14c493263cb3a5f65f5ddfd4603d19a76", "lessThan": "eb1ea64328d4cc7d7a912c563f8523d5259716ef", "status": "affected", "versionType": "git"}, {"version": "c8d2f34ea96ea3bce6ba2535f867f0d4ee3b22e1", "lessThan": "d52c04474feac8e305814a5228e622afe481b2ef", "status": "affected", "versionType": "git"}, {"version": "c8d2f34ea96ea3bce6ba2535f867f0d4ee3b22e1", "lessThan": "008ab3c53bc4f0b2f20013c8f6c204a3203d0b8b", "status": "affected", "versionType": "git"}, {"version": "4.19.313", "lessThan": "4.19.316", "status": "affected", "versionType": "semver"}, {"version": "5.4.275", "lessThan": "5.4.278", "status": "affected", "versionType": "semver"}, {"version": "5.10.216", "lessThan": "5.10.219", "status": "affected", "versionType": "semver"}, {"version": "5.15.157", "lessThan": "5.15.161", "status": "affected", "versionType": "semver"}, {"version": "6.1.88", "lessThan": "6.1.93", "status": "affected", "versionType": "semver"}, {"version": "6.6.29", "lessThan": "6.6.33", "status": "affected", "versionType": "semver"}, {"version": "6.8.8", "lessThan": "6.8.12", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/accessibility/speakup/main.c"], "versions": [{"version": "6.9", "status": "affected"}, {"version": "0", "lessThan": "6.9", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.316", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.278", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.219", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.161", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.93", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.33", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8.12", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9.3", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19.313", "versionEndExcluding": "4.19.316"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.275", "versionEndExcluding": "5.4.278"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.216", "versionEndExcluding": "5.10.219"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.157", "versionEndExcluding": "5.15.161"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.88", "versionEndExcluding": "6.1.93"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.29", "versionEndExcluding": "6.6.33"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8.8", "versionEndExcluding": "6.8.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.9.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.10"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/42f0a3f67158ed6b2908d2b9ffbf7e96d23fd358"}, {"url": "https://git.kernel.org/stable/c/cd7f3978c2ec741aedd1d860b2adb227314cf996"}, {"url": "https://git.kernel.org/stable/c/07ef95cc7a579731198c93beed281e3a79a0e586"}, {"url": "https://git.kernel.org/stable/c/504178fb7d9f6cdb0496d5491efb05f45597e535"}, {"url": "https://git.kernel.org/stable/c/3726f75a1ccc16cd335c0ccfad1d92ee08ecba5e"}, {"url": "https://git.kernel.org/stable/c/c6e1650cf5df1bd6638eeee231a683ef30c7d4eb"}, {"url": "https://git.kernel.org/stable/c/eb1ea64328d4cc7d7a912c563f8523d5259716ef"}, {"url": "https://git.kernel.org/stable/c/d52c04474feac8e305814a5228e622afe481b2ef"}, {"url": "https://git.kernel.org/stable/c/008ab3c53bc4f0b2f20013c8f6c204a3203d0b8b"}], "title": "speakup: Fix sizeof() vs ARRAY_SIZE() bug", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-noinfo Not enough information"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-06-20T14:49:14.118323Z", "id": "CVE-2024-38587", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-04T20:21:08.889Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/42f0a3f67158ed6b2908d2b9ffbf7e96d23fd358", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/cd7f3978c2ec741aedd1d860b2adb227314cf996", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/07ef95cc7a579731198c93beed281e3a79a0e586", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/504178fb7d9f6cdb0496d5491efb05f45597e535", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/3726f75a1ccc16cd335c0ccfad1d92ee08ecba5e", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/c6e1650cf5df1bd6638eeee231a683ef30c7d4eb", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/eb1ea64328d4cc7d7a912c563f8523d5259716ef", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/d52c04474feac8e305814a5228e622afe481b2ef", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/008ab3c53bc4f0b2f20013c8f6c204a3203d0b8b", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T17:21:38.044Z"}}, {"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T00:43:31.450Z"}, "affected": [{"vendor": "Siemens", "product": "RUGGEDCOM RST2428P", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.1", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family", "versions": [{"status": "unaffected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XCM-/XRM-/XCH-/XRH-300 family", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.1", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.1.1", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-613116.html"}]}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/42f0a3f67158ed6b2908d2b9ffbf7e96d23fd358", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/cd7f3978c2ec741aedd1d860b2adb227314cf996", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/07ef95cc7a579731198c93beed281e3a79a0e586", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/504178fb7d9f6cdb0496d5491efb05f45597e535", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/3726f75a1ccc16cd335c0ccfad1d92ee08ecba5e", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/c6e1650cf5df1bd6638eeee231a683ef30c7d4eb", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/eb1ea64328d4cc7d7a912c563f8523d5259716ef", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/d52c04474feac8e305814a5228e622afe481b2ef", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/008ab3c53bc4f0b2f20013c8f6c204a3203d0b8b", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T17:21:38.044Z"}}, {"affected": [{"vendor": "Siemens", "product": "RUGGEDCOM RST2428P", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.1", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family", "versions": [{"status": "unaffected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XCM-/XRM-/XCH-/XRH-300 family", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.1", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.1.1", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-613116.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T00:43:31.450Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-38587", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-20T14:49:14.118323Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-noinfo Not enough information"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-20T14:49:19.666Z"}}], "cna": {"title": "speakup: Fix sizeof() vs ARRAY_SIZE() bug", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is reached only through the local virtual console \u2014 writing screen content to an owned VC, resizing it via VT_RESIZE, and a speakup KT_SPKUP keypress delivered through the keyboard notifier; there is no network or remote-peer input involved. CVSS 3.1 AV:L covers attacks performed by a local user of the system, including those relying on a console-local action.\nAC:L - Every precondition is under the attacker's control: the tty owner can set vc_cols>257 himself via VT_RESIZE (vgacon accepts any from_user width fitting VRAM), write the \u2265257-character word with echo, place the reading cursor, and press the say-word key \u2014 a deterministic, repeatable overflow with no race and no memory-layout guessing.\nPR:L - Only an unprivileged local account with a virtual-console session is needed; VT_RESIZE and PIO_UNIMAP are granted to the tty owner without CAP_SYS_TTY_CONFIG (drivers/tty/vt/vt_ioctl.c:740), and writing to one's own /dev/ttyN requires no capability.\nUI:N - The attacker performs every step in his own console session \u2014 resize, print the long word, press the speakup key \u2014 so no second user has to be tricked into any action.\nS:U - The out-of-bounds write corrupts kernel .bss belonging to the speakup module, staying entirely within the kernel's own security authority with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - Overwriting adjacent pointer globals such as spk_characters[], spk_our_keys[], or the i18n message pointers with attacker-chosen 64-bit values turns speakup into an arbitrary kernel-memory read whose output is spoken out and readable from /dev/softsynth; the companion OOB read in spkup_write(buf, 512) also exposes adjacent kernel data.\nI:H - This is a 512-byte out-of-bounds write of fully attacker-chosen u16 values (arbitrary Unicode via a custom unimap) into a cluster of kernel pointers, including the spk_special_handler function pointer that is invoked directly on the next keypress \u2014 a direct control-flow hijack and arbitrary-write primitive.\nA:H - Corrupting neighbouring pointers such as tty, speakup_task, or speakup_console[] with garbage reliably produces an oops or panic even without a weaponized exploit, and the write can be repeated at will."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "756c5cb7c09e537b87b5d3acafcb101b2ccf394f", "lessThan": "42f0a3f67158ed6b2908d2b9ffbf7e96d23fd358", "versionType": "git"}, {"status": "affected", "version": "8f6b62125befe1675446923e4171eac2c012959c", "lessThan": "cd7f3978c2ec741aedd1d860b2adb227314cf996", "versionType": "git"}, {"status": "affected", "version": "6401038acfa24cba9c28cce410b7505efadd0222", "lessThan": "07ef95cc7a579731198c93beed281e3a79a0e586", "versionType": "git"}, {"status": "affected", "version": "0d130158db29f5e0b3893154908cf618896450a8", "lessThan": "504178fb7d9f6cdb0496d5491efb05f45597e535", "versionType": "git"}, {"status": "affected", "version": "89af25bd4b4bf6a71295f07e07a8ae7dc03c6595", "lessThan": "3726f75a1ccc16cd335c0ccfad1d92ee08ecba5e", "versionType": "git"}, {"status": "affected", "version": "8defb1d22ba0395b81feb963b96e252b097ba76f", "lessThan": "c6e1650cf5df1bd6638eeee231a683ef30c7d4eb", "versionType": "git"}, {"status": "affected", "version": "0efb15c14c493263cb3a5f65f5ddfd4603d19a76", "lessThan": "eb1ea64328d4cc7d7a912c563f8523d5259716ef", "versionType": "git"}, {"status": "affected", "version": "c8d2f34ea96ea3bce6ba2535f867f0d4ee3b22e1", "lessThan": "d52c04474feac8e305814a5228e622afe481b2ef", "versionType": "git"}, {"status": "affected", "version": "c8d2f34ea96ea3bce6ba2535f867f0d4ee3b22e1", "lessThan": "008ab3c53bc4f0b2f20013c8f6c204a3203d0b8b", "versionType": "git"}, {"status": "affected", "version": "4.19.313", "lessThan": "4.19.316", "versionType": "semver"}, {"status": "affected", "version": "5.4.275", "lessThan": "5.4.278", "versionType": "semver"}, {"status": "affected", "version": "5.10.216", "lessThan": "5.10.219", "versionType": "semver"}, {"status": "affected", "version": "5.15.157", "lessThan": "5.15.161", "versionType": "semver"}, {"status": "affected", "version": "6.1.88", "lessThan": "6.1.93", "versionType": "semver"}, {"status": "affected", "version": "6.6.29", "lessThan": "6.6.33", "versionType": "semver"}, {"status": "affected", "version": "6.8.8", "lessThan": "6.8.12", "versionType": "semver"}], "programFiles": ["drivers/accessibility/speakup/main.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.9"}, {"status": "unaffected", "version": "0", "lessThan": "6.9", "versionType": "semver"}, {"status": "unaffected", "version": "4.19.316", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.278", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.219", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.161", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.93", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.33", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.8.12", "versionType": "semver", "lessThanOrEqual": "6.8.*"}, {"status": "unaffected", "version": "6.9.3", "versionType": "semver", "lessThanOrEqual": "6.9.*"}, {"status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/accessibility/speakup/main.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/42f0a3f67158ed6b2908d2b9ffbf7e96d23fd358"}, {"url": "https://git.kernel.org/stable/c/cd7f3978c2ec741aedd1d860b2adb227314cf996"}, {"url": "https://git.kernel.org/stable/c/07ef95cc7a579731198c93beed281e3a79a0e586"}, {"url": "https://git.kernel.org/stable/c/504178fb7d9f6cdb0496d5491efb05f45597e535"}, {"url": "https://git.kernel.org/stable/c/3726f75a1ccc16cd335c0ccfad1d92ee08ecba5e"}, {"url": "https://git.kernel.org/stable/c/c6e1650cf5df1bd6638eeee231a683ef30c7d4eb"}, {"url": "https://git.kernel.org/stable/c/eb1ea64328d4cc7d7a912c563f8523d5259716ef"}, {"url": "https://git.kernel.org/stable/c/d52c04474feac8e305814a5228e622afe481b2ef"}, {"url": "https://git.kernel.org/stable/c/008ab3c53bc4f0b2f20013c8f6c204a3203d0b8b"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspeakup: Fix sizeof() vs ARRAY_SIZE() bug\n\nThe \"buf\" pointer is an array of u16 values. This code should be\nusing ARRAY_SIZE() (which is 256) instead of sizeof() (which is 512),\notherwise it can the still got out of bounds."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.19.316", "versionStartIncluding": "4.19.313"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.278", "versionStartIncluding": "5.4.275"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.219", "versionStartIncluding": "5.10.216"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.161", "versionStartIncluding": "5.15.157"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.93", "versionStartIncluding": "6.1.88"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.33", "versionStartIncluding": "6.6.29"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8.12", "versionStartIncluding": "6.8.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9.3", "versionStartIncluding": "6.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10", "versionStartIncluding": "6.9"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:33:00.055Z"}}}, "cveMetadata": {"cveId": "CVE-2024-38587", "state": "PUBLISHED", "dateUpdated": "2026-10-15T00:43:31.450Z", "dateReserved": "2024-06-18T19:36:34.929Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-06-19T13:37:42.537Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/accessibility/speakup/main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "42f0a3f67158ed6b2908d2b9ffbf7e96d23fd358", "status": "affected", "version": "756c5cb7c09e537b87b5d3acafcb101b2ccf394f", "versionType": "git"}, {"lessThan": "cd7f3978c2ec741aedd1d860b2adb227314cf996", "status": "affected", "version": "8f6b62125befe1675446923e4171eac2c012959c", "versionType": "git"}, {"lessThan": "07ef95cc7a579731198c93beed281e3a79a0e586", "status": "affected", "version": "6401038acfa24cba9c28cce410b7505efadd0222", "versionType": "git"}, {"lessThan": "504178fb7d9f6cdb0496d5491efb05f45597e535", "status": "affected", "version": "0d130158db29f5e0b3893154908cf618896450a8", "versionType": "git"}, {"lessThan": "3726f75a1ccc16cd335c0ccfad1d92ee08ecba5e", "status": "affected", "version": "89af25bd4b4bf6a71295f07e07a8ae7dc03c6595", "versionType": "git"}, {"lessThan": "c6e1650cf5df1bd6638eeee231a683ef30c7d4eb", "status": "affected", "version": "8defb1d22ba0395b81feb963b96e252b097ba76f", "versionType": "git"}, {"lessThan": "eb1ea64328d4cc7d7a912c563f8523d5259716ef", "status": "affected", "version": "0efb15c14c493263cb3a5f65f5ddfd4603d19a76", "versionType": "git"}, {"lessThan": "d52c04474feac8e305814a5228e622afe481b2ef", "status": "affected", "version": "c8d2f34ea96ea3bce6ba2535f867f0d4ee3b22e1", "versionType": "git"}, {"lessThan": "008ab3c53bc4f0b2f20013c8f6c204a3203d0b8b", "status": "affected", "version": "c8d2f34ea96ea3bce6ba2535f867f0d4ee3b22e1", "versionType": "git"}, {"lessThan": "4.19.316", "status": "affected", "version": "4.19.313", "versionType": "semver"}, {"lessThan": "5.4.278", "status": "affected", "version": "5.4.275", "versionType": "semver"}, {"lessThan": "5.10.219", "status": "affected", "version": "5.10.216", "versionType": "semver"}, {"lessThan": "5.15.161", "status": "affected", "version": "5.15.157", "versionType": "semver"}, {"lessThan": "6.1.93", "status": "affected", "version": "6.1.88", "versionType": "semver"}, {"lessThan": "6.6.33", "status": "affected", "version": "6.6.29", "versionType": "semver"}, {"lessThan": "6.8.12", "status": "affected", "version": "6.8.8", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/accessibility/speakup/main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.9"}, {"lessThan": "6.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.316", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.278", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.219", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.161", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.93", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.33", "versionType": "semver"}, {"lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.12", "versionType": "semver"}, {"lessThanOrEqual": "6.9.*", "status": "unaffected", "version": "6.9.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "RUGGEDCOM RST2428P", "vendor": "Siemens", "versions": [{"lessThan": "V3.1", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SCALANCE XCM-/XRM-/XCH-/XRH-300 family", "vendor": "Siemens", "versions": [{"lessThan": "V3.1", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "vendor": "Siemens", "versions": [{"lessThan": "V1.1.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C3A3E00C-AF83-424B-8A6F-F779432C5C82", "versionEndExcluding": "4.19.316", "versionStartIncluding": "4.19.313", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "466FC42E-75FE-4FDC-82C6-15C3FDE27AE2", "versionEndExcluding": "5.4.278", "versionStartIncluding": "5.4.275", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "148141E6-8BE1-411A-8827-03B1166336F6", "versionEndExcluding": "5.10.219", "versionStartIncluding": "5.10.216", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B654D858-BF90-4D2D-AF2D-A2DD8EC29BA6", "versionEndExcluding": "5.15.161", "versionStartIncluding": "5.15.157", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5EF60D2B-5C71-49D4-92A0-0B21749968AB", "versionEndExcluding": "6.1.93", "versionStartIncluding": "6.1.88", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B20F2535-E6A9-4C11-B5CE-3CE990AD9C22", "versionEndExcluding": "6.6.33", "versionStartIncluding": "6.6.29", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "30D1CFCA-A043-4D33-9686-31B2A044DE2F", "versionEndExcluding": "6.8.12", "versionStartIncluding": "6.8.8", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E07124C1-19E8-4D21-828D-9932A01D3011", "versionEndExcluding": "6.9.3", "versionStartIncluding": "6.9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspeakup: Fix sizeof() vs ARRAY_SIZE() bug\n\nThe \"buf\" pointer is an array of u16 values. This code should be\nusing ARRAY_SIZE() (which is 256) instead of sizeof() (which is 512),\notherwise it can the still got out of bounds."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Speakup: corrige el error sizeof() vs ARRAY_SIZE() El puntero \"buf\" es una matriz de valores u16. Este c\u00f3digo deber\u00eda usar ARRAY_SIZE() (que es 256) en lugar de sizeof() (que es 512), de lo contrario a\u00fan puede salirse de los l\u00edmites."}], "id": "CVE-2024-38587", "lastModified": "2026-10-15T01:18:30.113", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-38587", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-06-20T14:49:14.118323Z", "version": "2.0.3"}}]}, "published": "2024-06-19T14:15:18.800", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/008ab3c53bc4f0b2f20013c8f6c204a3203d0b8b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/07ef95cc7a579731198c93beed281e3a79a0e586"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3726f75a1ccc16cd335c0ccfad1d92ee08ecba5e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/42f0a3f67158ed6b2908d2b9ffbf7e96d23fd358"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/504178fb7d9f6cdb0496d5491efb05f45597e535"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c6e1650cf5df1bd6638eeee231a683ef30c7d4eb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cd7f3978c2ec741aedd1d860b2adb227314cf996"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d52c04474feac8e305814a5228e622afe481b2ef"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/eb1ea64328d4cc7d7a912c563f8523d5259716ef"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/008ab3c53bc4f0b2f20013c8f6c204a3203d0b8b"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/07ef95cc7a579731198c93beed281e3a79a0e586"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3726f75a1ccc16cd335c0ccfad1d92ee08ecba5e"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/42f0a3f67158ed6b2908d2b9ffbf7e96d23fd358"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/504178fb7d9f6cdb0496d5491efb05f45597e535"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c6e1650cf5df1bd6638eeee231a683ef30c7d4eb"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cd7f3978c2ec741aedd1d860b2adb227314cf996"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d52c04474feac8e305814a5228e622afe481b2ef"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/eb1ea64328d4cc7d7a912c563f8523d5259716ef"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-613116.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-129"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: speakup: Fix sizeof() vs ARRAY_SIZE() bug", "id": "2293401", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2293401"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nspeakup: Fix sizeof() vs ARRAY_SIZE() bug\nThe \"buf\" pointer is an array of u16 values. This code should be\nusing ARRAY_SIZE() (which is 256) instead of sizeof() (which is 512),\notherwise it can the still got out of bounds."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-38587", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-06-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-38587\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-38587\nhttps://lore.kernel.org/linux-cve-announce/2024061950-CVE-2024-38587-46ec@gregkh/T"], "statement": "Red Hat Enterprise Linux is not vulnerable to this CVE, as it does not affect the versions or configurations of the Linux kernel used in its distributions.", "threat_severity": "Moderate"}

{}