In X.Org X server 20.11 through 21.1.16, when a client application uses easystroke for mouse gestures, the main thread modifies various data structures used by the input thread without acquiring a lock, aka a race condition. In particular, AttachDevice in dix/devices.c does not acquire an input lock.
CVSS Details
- CVSS 3.1 Base Score: 7.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade xorg-x11-server-Xephyr-debuginfoUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-develUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-debugsourceUpgrade xorg-x11-server-Xnest-debuginfoUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-Xvfb-debuginfoUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-Xorg-debuginfoUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-debuginfo | Apr 15, 2025 | Mar 16, 2025 |
| Debian | — | No solution existsUpgrade xorg-server | May 15, 2025 | Mar 16, 2025 |
| Ubuntu | — | Upgrade xorg-server | Oct 30, 2025 | Mar 16, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub