Linux Kernel Xpad Driver Out-of-Bounds Access Vulnerability in Share Button Handling

A vulnerability has been identified in the Linux kernel Xpad driver, specifically in the handling of input packets for Xbox One controllers. The issue arises in the 'xpadone_process_packet' function, where the length of the received data is used to access specific bytes related to the Share button. This creates a risk of out-of-bounds memory access, as a malfunctioning controller can send a packet with an actual length less than 18 bytes, leading to access beyond the intended array boundaries. The vulnerability has been addressed by implementing proper length checks and calculating offsets before accessing the data.

Impact

Exploitation of this vulnerability could lead to out-of-bounds memory access, potentially causing undefined behavior or memory corruption.

Reproduction

The vulnerability can be reproduced by using a faulty controller that sends GIP_CMD_INPUT packets with a length less than 18 bytes. The 'xpadone_process_packet' function will then access memory outside the bounds of the intended array, causing an out-of-bounds access.

Remediation

Users can upgrade to the patched version of the Linux kernel available in the official Linux Git repository.