In X.Org X server 20.11 through 21.1.16, when a client application uses easystroke for mouse gestures, the main thread modifies various data structures used by the input thread without acquiring a lock, aka a race condition. In particular, AttachDevice in dix/devices.c does not acquire an input lock.
CVSS Details
- CVSS 3.1 Base Score: 7.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade xorg-x11-server-develUpgrade xorg-x11-server-debugsourceUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-Xephyr-debuginfoUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-Xorg-debuginfoUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-Xnest-debuginfoUpgrade xorg-x11-server-Xvfb-debuginfoUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-debuginfo | Apr 15, 2025 | Mar 16, 2025 |
| Debian | — | No solution existsUpgrade xorg-server | May 15, 2025 | Mar 16, 2025 |
| Ubuntu | — | Upgrade xorg-server | Oct 30, 2025 | Mar 16, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub