CVE-2025-20091
Published: 04 March 2025
Summary
CVE-2025-20091 is a low-severity Use After Free (CWE-416) vulnerability in Openatom Openharmony. Its CVSS base score is 3.8 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 26.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-39 (Process Isolation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the use-after-free flaw in OpenHarmony pre-installed apps through timely identification, reporting, and patching.
Implements memory protection mechanisms such as ASLR and DEP that directly prevent exploitation of the use-after-free vulnerability leading to arbitrary code execution.
Enforces process isolation for pre-installed apps, containing arbitrary code execution by a local low-privilege attacker to the compromised app context.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The use-after-free vulnerability directly enables local arbitrary code execution by a low-privileged attacker in pre-installed applications, mapping to exploitation of software vulnerabilities for privilege escalation.
NVD Description
in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free. This vulnerability can be exploited only in restricted scenarios.
Deeper analysisAI
CVE-2025-20091 is a use-after-free vulnerability (CWE-416) affecting OpenHarmony versions v5.0.2 and prior. It enables a local attacker to achieve arbitrary code execution within pre-installed applications on affected systems. The vulnerability was published on 2025-03-04 and carries a CVSS v3.1 base score of 3.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N), indicating low severity with local access required, low privileges, low complexity, and a changed scope impacting confidentiality.
A local attacker with low privileges can exploit this vulnerability to execute arbitrary code in the context of pre-installed apps, but only in restricted scenarios as noted in the description. The attack requires physical or local access to the device and does not involve user interaction, though the scope change suggests potential for broader impact within the scoped components.
The OpenHarmony security advisory at https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-03.md provides further details on disclosure and likely mitigation steps for this issue.
Details
- CWE(s)