Race Condition in X.Org X Server Affects Mouse Gesture Functionality

CVE-2022-49737

What is CVE-2022-49737?

In versions 20.11 through 21.1.16 of the X.Org X server, a race condition occurs when client applications utilize easystroke for mouse gestures. This flaw allows the main thread to modify data structures used by the input thread without proper locking mechanisms. Specifically, the AttachDevice function in dix/devices.c fails to acquire an input lock, potentially leading to unpredictable behavior and security issues.

References