CVE-2022-49737

EUVD-2022-55160
In X.Org X server 20.11 through 21.1.16, when a client application uses easystroke for mouse gestures, the main thread modifies various data structures used by the input thread without acquiring a lock, aka a race condition. In particular, AttachDevice in dix/devices.c does not acquire an input lock.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.7 HIGH
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 23%
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
xorg
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
not-affected
oracular
not-affected
xenial
not-affected
xorg-hwe-16.04
focal
dne
jammy
dne
noble
dne
oracular
dne
xenial
not-affected
xorg-hwe-18.04
bionic
not-affected
focal
dne
jammy
dne
noble
dne
oracular
dne
xorg-server
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
oracular
needs-triage
xenial
needs-triage
xorg-server-hwe-16.04
focal
dne
jammy
dne
noble
dne
oracular
dne
xenial
needs-triage
xorg-server-hwe-18.04
bionic
needs-triage
focal
dne
jammy
dne
noble
dne
oracular
dne
xwayland
focal
dne
jammy
needs-triage
noble
needs-triage
oracular
needs-triage
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
xorg-x11-server
suse enterprise desktop 15 SP6
21.1.11-150600.5.9.1
fixed
suse enterprise desktop 15 SP7
21.1.15-150700.3.2
fixed
suse enterprise sap 15 SP6
21.1.11-150600.5.9.1
fixed
suse enterprise sap 15 SP7
21.1.15-150700.3.2
fixed
suse enterprise server 15 SP6
21.1.11-150600.5.9.1
fixed
suse enterprise server 15 SP7
21.1.15-150700.3.2
fixed
xorg-x11-server-Xvfb
suse enterprise desktop 15 SP6
21.1.11-150600.5.9.1
fixed
suse enterprise desktop 15 SP7
21.1.15-150700.3.2
fixed
suse enterprise sap 15 SP6
21.1.11-150600.5.9.1
fixed
suse enterprise sap 15 SP7
21.1.15-150700.3.2
fixed
suse enterprise server 15 SP6
21.1.11-150600.5.9.1
fixed
suse enterprise server 15 SP7
21.1.15-150700.3.2
fixed
xorg-x11-server-extra
suse enterprise desktop 15 SP6
21.1.11-150600.5.9.1
fixed
suse enterprise desktop 15 SP7
21.1.15-150700.3.2
fixed
suse enterprise sap 15 SP6
21.1.11-150600.5.9.1
fixed
suse enterprise sap 15 SP7
21.1.15-150700.3.2
fixed
suse enterprise server 15 SP6
21.1.11-150600.5.9.1
fixed
suse enterprise server 15 SP7
21.1.15-150700.3.2
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
xorg-x11-server-Xephyr
Amazon Linux 2023
0:21.1.13-5.amzn2023.0.5
fixed
xorg-x11-server-Xephyr-debuginfo
Amazon Linux 2023
0:21.1.13-5.amzn2023.0.5
fixed
xorg-x11-server-Xnest
Amazon Linux 2023
0:21.1.13-5.amzn2023.0.5
fixed
xorg-x11-server-Xnest-debuginfo
Amazon Linux 2023
0:21.1.13-5.amzn2023.0.5
fixed
xorg-x11-server-Xorg
Amazon Linux 2023
0:21.1.13-5.amzn2023.0.5
fixed
xorg-x11-server-Xorg-debuginfo
Amazon Linux 2023
0:21.1.13-5.amzn2023.0.5
fixed
xorg-x11-server-Xvfb
Amazon Linux 2023
0:21.1.13-5.amzn2023.0.5
fixed
xorg-x11-server-Xvfb-debuginfo
Amazon Linux 2023
0:21.1.13-5.amzn2023.0.5
fixed
xorg-x11-server-common
Amazon Linux 2023
0:21.1.13-5.amzn2023.0.5
fixed
xorg-x11-server-debuginfo
Amazon Linux 2023
0:21.1.13-5.amzn2023.0.5
fixed
xorg-x11-server-debugsource
Amazon Linux 2023
0:21.1.13-5.amzn2023.0.5
fixed
xorg-x11-server-devel
Amazon Linux 2023
0:21.1.13-5.amzn2023.0.5
fixed
xorg-x11-server-source
Amazon Linux 2023
0:21.1.13-5.amzn2023.0.5
fixed
Common Weakness Enumeration
References
https://bugs.debian.org/cgi-bin/bugreport.cgi?att=1;bug=1081338;filename=dix-Hold-input-lock-for-AttachDevice.patch;msg=5
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1081338
https://gitlab.freedesktop.org/xorg/xserver/-/commit/dc7cb45482cea6ccec22d117ca0b489500b4d0a0
https://gitlab.freedesktop.org/xorg/xserver/-/issues/1260
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1081338