Race Condition in X.Org X Server Affects Mouse Gesture Functionality
CVE-2022-49737

7.7HIGH

Key Information:

Vendor

X.org

Status
X Server
Vendor
CVE Published:
16 March 2025

What is CVE-2022-49737?

In versions 20.11 through 21.1.16 of the X.Org X server, a race condition occurs when client applications utilize easystroke for mouse gestures. This flaw allows the main thread to modify data structures used by the input thread without proper locking mechanisms. Specifically, the AttachDevice function in dix/devices.c fails to acquire an input lock, potentially leading to unpredictable behavior and security issues.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

X server 20.11 <= 21.1.16

References

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1081338
https://gitlab.freedesktop.org/xorg/xserver/-/issues/1260
https://bugs.debian.org/cgi-bin/bugreport.cgi?att=1;bug=1...

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

JSON
.