CVE-2024-57955
Published: 06 February 2025
Summary
CVE-2024-57955 is a medium-severity Out-of-bounds Write (CWE-787) vulnerability in Huawei Harmonyos. Its CVSS base score is 6.1 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 28.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the arbitrary write vulnerability by applying Huawei's issued patches to remediate the flaw in the Gallery module.
Enforces validation of inputs processed by the Gallery module to prevent malformed data causing the out-of-bounds write (CWE-787).
Provides memory protection mechanisms like non-executable memory and address space randomization to limit successful exploitation of the arbitrary write even if unpatched.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Arbitrary write (CWE-787) in local Gallery module enables local exploitation for privilege escalation (T1068) via malicious file triggering (T1204.002) with UI:R.
NVD Description
Arbitrary write vulnerability in the Gallery module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
Deeper analysisAI
CVE-2024-57955 is an arbitrary write vulnerability (CWE-787) in the Gallery module. Published on 2025-02-06, it carries a CVSS v3.1 base score of 6.1 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) and may affect service confidentiality upon successful exploitation.
The vulnerability can be exploited by a local attacker with no privileges required, provided they can induce user interaction and leverage low attack complexity. Exploitation enables high-impact confidentiality loss and low-impact integrity modification, such as unauthorized data writes.
Huawei has issued a consumer support bulletin detailing the vulnerability and mitigation measures at https://consumer.huawei.com/en/support/bulletin/2025/2/.
Details
- CWE(s)