CVE-2022-49737CWE-413

In X.Org X server 20.11 through 21.1.16, when a client application uses easystroke for mouse gestures, the main thread modifies various data structures used by…

High · published March 16, 2025

CVSS v3.1
7.7
EPSS
0%
Percentile
26.4
In the wild
Unconfirmed
What it is

In X.Org X server 20.11 through 21.1.16, when a client application uses easystroke for mouse gestures, the main thread modifies various data structures used by the input thread without acquiring a lock, aka a race condition. In particular, AttachDevice in dix/devices.c does not acquire an input lock.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00341 · 26.4th percentile
Weakness
CWE-413 · Improper Resource Locking
Published
2025-03-16T00:00Z
EPSS history
Timeline
  • 16 MAR 00:00Z
    In X.Org X server 20.11 through 21.1.16, when a client application uses easystroke for mouse gestures, the main thread modifies various data structures used by…
    cvelistv5