CVE-2022-49737

Published: Mar 16, 2025Modified: Jun 17, 2026Deferred

7.7

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H

Exploitability: 1.8 / Impact: 5.3

Source: MITRE (Secondary)

Description

In X.Org X server 20.11 through 21.1.16, when a client application uses easystroke for mouse gestures, the main thread modifies various data structures used by the input thread without acquiring a lock, aka a race condition. In particular, AttachDevice in dix/devices.c does not acquire an input lock.

Related CWEs

CWE-413

Improper Resource Locking

The product does not lock or does not correctly lock a resource when the product must have exclusive access to the resource.

References (5)

https://bugs.debian.org/cgi-bin/bugreport.cgi?att=1;bug=1081338;filename=dix-Hold-input-lock-for-AttachDevice.patch;msg=5

Source: cve@mitre.org

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1081338

Source: cve@mitre.org

https://gitlab.freedesktop.org/xorg/xserver/-/commit/dc7cb45482cea6ccec22d117ca0b489500b4d0a0

Source: cve@mitre.org

https://gitlab.freedesktop.org/xorg/xserver/-/issues/1260

Source: cve@mitre.org

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1081338

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.