In X.Org X server 20.11 through 21.1.16, when a client application uses easystroke for mouse gestures, the main thread modifies various data structures used by the input thread without acquiring a lock, aka a race condition. In particular, AttachDevice in dix/devices.c does not acquire an input lock.
CVSS Details
- CVSS 3.1 Base Score: 7.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade xorg-x11-server-Xephyr-debuginfoUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-debugsourceUpgrade xorg-x11-server-develUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-Xnest-debuginfoUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-Xvfb-debuginfoUpgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-Xorg-debuginfoUpgrade xorg-x11-server-Xvfb | Apr 15, 2025 | Mar 16, 2025 |
| Debian | — | Upgrade xorg-serverNo solution exists | May 15, 2025 | Mar 16, 2025 |
| Ubuntu | — | Upgrade xorg-server | Oct 30, 2025 | Mar 16, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub