CVE-2024-38587

speakup: Fix sizeof() vs ARRAY_SIZE() bug

Description

In the Linux kernel, the following vulnerability has been resolved: speakup: Fix sizeof() vs ARRAY_SIZE() bug The "buf" pointer is an array of u16 values. This code should be using ARRAY_SIZE() (which is 256) instead of sizeof() (which is 512), otherwise it can the still got out of bounds.

Category

5.3
CVSS
Severity: Medium
CVSS 3.1 •
EPSS 1.03% Top 25%
Affected: Linux Linux
Affected: Linux Linux
Published at:
Updated at:

References

Link Tags
https://git.kernel.org/stable/c/42f0a3f67158ed6b2908d2b9ffbf7e96d23fd358 patch
https://git.kernel.org/stable/c/cd7f3978c2ec741aedd1d860b2adb227314cf996 patch
https://git.kernel.org/stable/c/07ef95cc7a579731198c93beed281e3a79a0e586 patch
https://git.kernel.org/stable/c/504178fb7d9f6cdb0496d5491efb05f45597e535 patch
https://git.kernel.org/stable/c/3726f75a1ccc16cd335c0ccfad1d92ee08ecba5e patch
https://git.kernel.org/stable/c/c6e1650cf5df1bd6638eeee231a683ef30c7d4eb patch
https://git.kernel.org/stable/c/eb1ea64328d4cc7d7a912c563f8523d5259716ef patch
https://git.kernel.org/stable/c/d52c04474feac8e305814a5228e622afe481b2ef patch
https://git.kernel.org/stable/c/008ab3c53bc4f0b2f20013c8f6c204a3203d0b8b patch

Frequently Asked Questions

What is the severity of CVE-2024-38587?
CVE-2024-38587 has been scored as a medium severity vulnerability.
How to fix CVE-2024-38587?
To fix CVE-2024-38587, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-38587 being actively exploited in the wild?
It is possible that CVE-2024-38587 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~1% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-38587?
CVE-2024-38587 affects Linux Linux, Linux Linux.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.