Junglewise Threat Intelligence

CVE-2024-38587: Linux Kernel out-of-bounds write in speakup screen reader

CVE-2024-38587 · Severity: medium · CVSS 5.3 · Published 2024-06-19

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel's 'speakup' screen reader component, which provides accessibility features for visually impaired users. Due to a coding error in how memory is measured, the system may attempt to write data beyond the intended boundaries when processing long words. This could lead to a system crash or instability, potentially disrupting operations for users relying on this accessibility tool.

Technical details

An out-of-bounds write vulnerability (CWE-129) exists in drivers/accessibility/speakup/main.c within the get_word() function. The code incorrectly used the sizeof() operator on a u16 array ('buf'), which returned the size in bytes (512) rather than the number of elements (256). This logic error allows the 'cnt' index to exceed the actual array bounds during a while loop that processes characters from the virtual console. An attacker could potentially trigger this by providing specially crafted long strings to the console, leading to memory corruption or a kernel oops. The issue has been patched across multiple stable kernel branches by replacing sizeof() with ARRAY_SIZE().

Affected products

  • Linux Linux Kernel 4.19.313 to 4.19.316, 5.4.275 to 5.4.278, 5.10.216 to 5.10.219, 5.15.157 to 5.15.161, 6.1.88 to 6.1.93, 6.6.29 to 6.6.33, 6.8.8 to 6.8.12, 6.9 to 6.9.3

Timeline

  • 2024-06-19: disclosed
  • 2024-05-08: patched: Initial patch committed to stable tree

References

Related threats