7.7

CVE-2022-49737

In X.Org X server 20.11 through 21.1.16, when a client application uses easystroke for mouse gestures, the main thread modifies various data structures used by the input thread without acquiring a lock, aka a race condition. In particular, AttachDevice in dix/devices.c does not acquire an input lock.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerX.org
≫
Produkt X server
Default Statusunknown
Version <= 21.1.16
Version 20.11
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.1% 0.261
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
cve@mitre.org 7.7 1.8 5.3
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H
CWE-413 Improper Resource Locking

The product does not lock or does not correctly lock a resource when the product must have exclusive access to the resource.