CVE-2024-57958
Published: 06 February 2025
Summary
CVE-2024-57958 is a medium-severity Out-of-bounds Read (CWE-125) vulnerability in Huawei Harmonyos. Its CVSS base score is 5.7 (Medium).
Operationally, ranked at the 16.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-57958 is an out-of-bounds array read vulnerability (CWE-125) in the FFRT module. This flaw affects certain Huawei consumer products, as detailed in the vendor's security bulletin.
The vulnerability has a CVSS v3.1 base score of 5.7 (AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L), indicating it can be exploited by a local attacker requiring no privileges or user interaction, with low attack complexity. Successful exploitation may allow the attacker to cause features to perform abnormally, resulting in low-impact confidentiality and availability effects due to the changed scope.
Huawei has published a security bulletin at https://consumer.huawei.com/en/support/bulletin/2025/2/ addressing this vulnerability, which security practitioners should consult for mitigation details and available patches.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-53860
Vulnerability details
Out-of-bounds array read vulnerability in the FFRT module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Insufficient information to map techniques.CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the CVE by requiring identification, reporting, correction, and verification of the specific out-of-bounds array read flaw through vendor patches.
Implements memory protection mechanisms that prevent exploitation of out-of-bounds array reads due to pointer dereference errors or invalid memory access.
Vulnerability scanning detects the presence of this specific out-of-bounds read vulnerability in the FFRT module for timely remediation.