High · published June 19, 2024
In the Linux kernel, the following vulnerability has been resolved:
speakup: Fix sizeof() vs ARRAY_SIZE() bug
The "buf" pointer is an array of u16 values. This code should be
using ARRAY_SIZE() (which is 256) instead of sizeof() (which is 512),
otherwise it can the still got out of bounds.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 4.19.313, < 4.19.316 | 4.19.316 |
| linux/linux_kernel | ≥ 5.4.275, < 5.4.278 | 5.4.278 |
| linux/linux_kernel | ≥ 5.10.216, < 5.10.219 | 5.10.219 |
| linux/linux_kernel | ≥ 5.15.157, < 5.15.161 | 5.15.161 |
| linux/linux_kernel | ≥ 6.1.88, < 6.1.93 | 6.1.93 |
| linux/linux_kernel | ≥ 6.6.29, < 6.6.33 | 6.6.33 |
| linux/linux_kernel | ≥ 6.8.8, < 6.8.12 | 6.8.12 |
| linux/linux_kernel | ≥ 6.9, < 6.9.3 | 6.9.3 |