{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2024-38587",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2024-38587"
  ],
  "published": "2024-06-19T13:37:58Z",
  "summary": "speakup: Fix sizeof() vs ARRAY_SIZE() bug",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nspeakup: Fix sizeof() vs ARRAY_SIZE() bug\n\nThe \"buf\" pointer is an array of u16 values.  This code should be\nusing ARRAY_SIZE() (which is 256) instead of sizeof() (which is 512),\notherwise it can the still got out of bounds.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.6.31-1+rpt1"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.6.31+rpt-rpi-2712",
            "binary_version": "1:6.6.31-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.31+rpt-rpi-v6",
            "binary_version": "1:6.6.31-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.31+rpt-rpi-v7",
            "binary_version": "1:6.6.31-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.31+rpt-rpi-v7l",
            "binary_version": "1:6.6.31-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.31+rpt-rpi-v8",
            "binary_version": "1:6.6.31-1+rpt1"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.6.31-1+rpt1": {
            "linux_commit": "c1432b4bae5b6582f4d32ba381459f33c34d1424",
            "upstream_version": "6.6.31",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.6.33"
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-38587"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/42f0a3f67158ed6b2908d2b9ffbf7e96d23fd358"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/cd7f3978c2ec741aedd1d860b2adb227314cf996"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/07ef95cc7a579731198c93beed281e3a79a0e586"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/504178fb7d9f6cdb0496d5491efb05f45597e535"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/3726f75a1ccc16cd335c0ccfad1d92ee08ecba5e"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/c6e1650cf5df1bd6638eeee231a683ef30c7d4eb"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/eb1ea64328d4cc7d7a912c563f8523d5259716ef"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/d52c04474feac8e305814a5228e622afe481b2ef"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/008ab3c53bc4f0b2f20013c8f6c204a3203d0b8b"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T11:52:36Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 7.8,
      "cvss_v3_severity": "High",
      "scenario": "AV:L - The vulnerable path is reached only through the local virtual console \u2014 writing screen content to an owned VC, resizing it via VT_RESIZE, and a speakup KT_SPKUP keypress delivered through the keyboard notifier; there is no network or remote-peer input involved. CVSS 3.1 AV:L covers attacks performed by a local user of the system, including those relying on a console-local action.\nAC:L - Every precondition is under the attacker's control: the tty owner can set vc_cols>257 himself via VT_RESIZE (vgacon accepts any from_user width fitting VRAM), write the \u2265257-character word with echo, place the reading cursor, and press the say-word key \u2014 a deterministic, repeatable overflow with no race and no memory-layout guessing.\nPR:L - Only an unprivileged local account with a virtual-console session is needed; VT_RESIZE and PIO_UNIMAP are granted to the tty owner without CAP_SYS_TTY_CONFIG (drivers/tty/vt/vt_ioctl.c:740), and writing to one's own /dev/ttyN requires no capability.\nUI:N - The attacker performs every step in his own console session \u2014 resize, print the long word, press the speakup key \u2014 so no second user has to be tricked into any action.\nS:U - The out-of-bounds write corrupts kernel .bss belonging to the speakup module, staying entirely within the kernel's own security authority with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - Overwriting adjacent pointer globals such as spk_characters[], spk_our_keys[], or the i18n message pointers with attacker-chosen 64-bit values turns speakup into an arbitrary kernel-memory read whose output is spoken out and readable from /dev/softsynth; the companion OOB read in spkup_write(buf, 512) also exposes adjacent kernel data.\nI:H - This is a 512-byte out-of-bounds write of fully attacker-chosen u16 values (arbitrary Unicode via a custom unimap) into a cluster of kernel pointers, including the spk_special_handler function pointer that is invoked directly on the next keypress \u2014 a direct control-flow hijack and arbitrary-write primitive.\nA:H - Corrupting neighbouring pointers such as tty, speakup_task, or speakup_console[] with garbage reliably produces an oops or panic even without a weaponized exploit, and the write can be repeated at will."
    }
  }
}