CVE-2025-24301
Published: 04 March 2025
Summary
CVE-2025-24301 is a low-severity Use After Free (CWE-416) vulnerability in Openatom Openharmony. Its CVSS base score is 3.8 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 30.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the use-after-free vulnerability by identifying, prioritizing, and applying patches or updates to affected OpenHarmony versions.
Implements memory protection mechanisms such as ASLR, DEP, and stack canaries to prevent exploitation of the use-after-free for arbitrary code execution.
Enforces least privilege to restrict the scope and impact of arbitrary code execution achieved by a low-privilege local attacker in pre-installed apps.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The use-after-free vulnerability enables local low-privileged arbitrary code execution in pre-installed apps with changed scope, directly mapping to exploitation for privilege escalation.
NVD Description
in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free. This vulnerability can be exploited only in restricted scenarios.
Deeper analysisAI
CVE-2025-24301 is a use-after-free vulnerability (CWE-416) affecting OpenHarmony versions v5.0.2 and prior. It enables a local attacker to achieve arbitrary code execution within pre-installed apps. The issue is confined to restricted scenarios, as indicated by its low CVSS v3.1 base score of 3.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N), reflecting local access vector, low attack complexity, low privileges required, no user interaction, changed scope, and limited confidentiality impact with no integrity or availability effects.
A local attacker with low privileges can exploit this vulnerability to execute arbitrary code in the context of pre-installed applications. Exploitation requires physical or logical access to the device running the affected OpenHarmony version, but the changed scope (S:C) suggests potential propagation to higher privilege contexts despite the low impact profile.
Mitigation details are available in the OpenHarmony security advisory at https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-03.md, published on 2025-03-04.
Details
- CWE(s)