CVE-2024-56436
Published: 08 January 2025
Summary
CVE-2024-56436 is a medium-severity Improper Restriction of Rendered UI Layers or Frames (CWE-1021) vulnerability in Huawei Harmonyos. Its CVSS base score is 5.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Screen Capture (T1113); ranked at the 27.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-4 (Information Flow Enforcement) and SC-39 (Process Isolation).
Deeper analysis
CVE-2024-56436 is a cross-process screen stack vulnerability in the UIExtension module. It carries a CVSS v3.1 base score of 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) and is linked to CWE-1021 (as well as NVD-CWE-noinfo). Successful exploitation may affect service confidentiality.
A local attacker with no privileges required can exploit this vulnerability through low-complexity attacks that necessitate user interaction. Upon success, the attacker achieves high confidentiality impact, enabling unauthorized access to sensitive data across processes without affecting integrity or availability.
Huawei has published a security bulletin with further details at https://consumer.huawei.com/en/support/bulletin/2025/1/.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-53145
Vulnerability details
Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Cross-process screen stack vulnerability directly enables unauthorized capture of screen/UI data from other processes (CWE-1021), mapping to screen capture for confidentiality impact.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Prevents unauthorized and unintended information transfer via shared system resources, directly addressing the cross-process screen stack vulnerability that leaks sensitive data.
Maintains separate execution domains for processes, mitigating unauthorized cross-process access exploited in the UIExtension screen stack flaw.
Enforces approved authorizations for information flows within the system, restricting unauthorized data sharing across processes via the screen stack.