In X.Org X server 20.11 through 21.1.16, when a client application uses easystroke for mouse gestures, the main thread modifies various data structures used by the input thread without acquiring a lock, aka a race condition. In particular, AttachDevice in dix/devices.c does not acquire an input lock.
CVSS Details
- CVSS 3.1 Base Score: 7.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade xorg-x11-server-Xnest-debuginfoUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-Xorg-debuginfoUpgrade xorg-x11-server-Xvfb-debuginfoUpgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-debugsourceUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-develUpgrade xorg-x11-server-Xephyr-debuginfo | Apr 15, 2025 | Mar 16, 2025 |
| Debian | — | No solution existsUpgrade xorg-server | May 15, 2025 | Mar 16, 2025 |
| Ubuntu | — | Upgrade xorg-server | Oct 30, 2025 | Mar 16, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub