CVE-2022-49737
Fixed in a distro release EPSS <1%CVSS 7.7
In X.Org X server 20.11 through 21.1.16, when a client application uses easystroke for mouse gestures, the main thread modifies various data structures used by the input thread without acquiring a lock, aka a race condition. In particular, AttachDevice in dix/devices.c does not acquire an input lock.
Products: x.org x_server
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2023 | xorg-x11-server-Xephyr | 21.1.13-5.amzn2023.0.5 |
| Amazon Linux 2023 | xorg-x11-server-Xnest | 21.1.13-5.amzn2023.0.5 |
| Amazon Linux 2023 | xorg-x11-server-Xorg | 21.1.13-5.amzn2023.0.5 |
| Amazon Linux 2023 | xorg-x11-server-Xvfb | 21.1.13-5.amzn2023.0.5 |
| Amazon Linux 2023 | xorg-x11-server-common | 21.1.13-5.amzn2023.0.5 |
| Amazon Linux 2023 | xorg-x11-server-devel | 21.1.13-5.amzn2023.0.5 |
| Amazon Linux 2023 | xorg-x11-server-source | 21.1.13-5.amzn2023.0.5 |
| Chainguard | xorg-server | 21.1.20-r0 |
| Debian 12 | xorg-server | 2:21.1.7-3+deb12u13 |
| Debian 13 | xorg-server | 2:21.1.16-1.1 |
| Debian 14 | xorg-server | 2:21.1.16-1.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP6 | xorg-x11-server | 21.1.11-150600.5.9.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP6 | xorg-x11-server | 21.1.11-150600.5.9.1 |
| Ubuntu 22.04 LTS | xorg-server | no fix |
| Ubuntu 22.04 LTS | xwayland | no fix |
| Ubuntu 24.04 LTS | xorg-server | no fix |
| Ubuntu 24.04 LTS | xwayland | no fix |
| Ubuntu 25.10 | xorg-server | 2:21.1.18-1ubuntu1 |
| Ubuntu 25.10 | xwayland | no fix |
| Ubuntu 26.04 LTS | xorg-server | 2:21.1.18-1ubuntu1 |
| Ubuntu 26.04 LTS | xwayland | no fix |
| Ubuntu 26.10 | xwayland | no fix |
| Ubuntu Pro 14.04 LTS | xorg-server | no fix |
| Ubuntu Pro 16.04 LTS | xorg-server | no fix |
| Ubuntu Pro 16.04 LTS | xorg-server-hwe-16.04 | no fix |
| Ubuntu Pro 18.04 LTS | xorg-server | no fix |
| Ubuntu Pro 18.04 LTS | xorg-server-hwe-18.04 | no fix |
| Ubuntu Pro 20.04 LTS | xorg-server | no fix |
| Wolfi | xorg-server | 21.1.20-r0 |
| openSUSE Leap 15.6 | xorg-x11-server | 21.1.11-150600.5.9.1 |
| openSUSE Tumbleweed | xorg-x11-server | 21.1.15-3.1 |