CVE-2025-24301 Overview
CVE-2025-24301 is a use-after-free vulnerability [CWE-416] affecting OpenHarmony v5.0.2 and prior versions. A local attacker can leverage the flaw to achieve arbitrary code execution within pre-installed applications on the affected device. The OpenAtom Foundation acknowledged the issue in its March 2025 security disclosure. Exploitation requires local access and low privileges, and the vendor notes the flaw is only reachable in restricted scenarios. Successful exploitation compromises the confidentiality, integrity, and availability of the targeted application context.
Critical Impact
Local attackers can execute arbitrary code inside pre-installed OpenHarmony applications, breaking the trust boundary of system-provisioned software.
Affected Products
- OpenAtom OpenHarmony v5.0.2
- OpenAtom OpenHarmony prior versions
- Pre-installed applications shipped on OpenHarmony devices
Discovery Timeline
- 2025-03-04 - CVE-2025-24301 published to the National Vulnerability Database (NVD)
- 2025-03 - OpenAtom publishes OpenHarmony security disclosure covering the issue
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-24301
Vulnerability Analysis
The vulnerability is a use-after-free condition in OpenHarmony, the open-source distributed operating system maintained by the OpenAtom Foundation. Use-after-free flaws occur when a program continues to reference memory after it has been released back to the allocator. An attacker who can influence the reuse of that memory can steer program execution toward attacker-controlled data.
In this case, the freed object is reachable from pre-installed application code paths. When the dangling pointer is dereferenced, the attacker gains control of function pointers or object metadata within the process. This yields arbitrary code execution inside the compromised application's sandbox.
The attack vector is local, and the attacker must already hold low privileges on the device. The vendor advisory notes that exploitation is only possible in restricted scenarios, which limits the practical attack surface but does not eliminate risk on multi-user or compromised devices. Refer to the OpenHarmony Security Disclosure 2025 for vendor-supplied technical details.
Root Cause
The root cause is improper object lifetime management in OpenHarmony components consumed by pre-installed applications. A reference to a heap object is retained after the allocation is freed, producing a dangling pointer that the process later dereferences.
Attack Vector
A local, authenticated attacker triggers the vulnerable code path from a lower-privileged context. By racing or shaping heap allocations, the attacker reclaims the freed memory with controlled data before the stale reference is used. The subsequent dereference redirects execution into attacker-controlled code within the pre-installed application.
No public proof-of-concept, exploit code, or CISA KEV listing is currently associated with this CVE. The EPSS probability remains low.
Detection Methods for CVE-2025-24301
Indicators of Compromise
- Unexpected crashes, SIGSEGV, or abort signals originating from OpenHarmony pre-installed applications.
- Anomalous child processes or code loading events spawned by system-provisioned apps.
- Application log entries showing memory allocator errors or double-free warnings near the time of a crash.
Detection Strategies
- Monitor OpenHarmony device telemetry for repeated crashes of the same pre-installed application, which can indicate exploitation attempts against a use-after-free primitive.
- Correlate local process launches with unusual system calls or file writes originating from pre-installed application UIDs.
- Track installation of untrusted local applications, since exploitation requires prior local access.
Monitoring Recommendations
- Ingest OpenHarmony crash dumps and hilog output into a central logging pipeline for retention and analysis.
- Alert on repeated abnormal termination of the same signed pre-installed application within short time windows.
- Baseline normal behavior of pre-installed apps so that new outbound connections or privilege changes trigger review.
How to Mitigate CVE-2025-24301
Immediate Actions Required
- Inventory OpenHarmony devices and confirm firmware versions against v5.0.2 and earlier.
- Apply the vendor-supplied patch referenced in the OpenHarmony Security Disclosure 2025 as soon as it is available for the affected build.
- Restrict installation of untrusted local applications, since local access is a precondition for exploitation.
Patch Information
OpenAtom addresses this vulnerability in versions released after OpenHarmony v5.0.2. Device vendors and OEMs shipping OpenHarmony-based firmware should integrate the upstream fix and distribute updated builds to end users. Consult the vendor advisory for the specific commit and component references.
Workarounds
- Limit physical and logical access to affected devices to trusted users while patches are rolled out.
- Disable or remove non-essential pre-installed applications that expose the vulnerable code path where operationally feasible.
- Enforce least privilege for all local accounts and services running on OpenHarmony devices.
# Verify OpenHarmony version on a device via hdc shell
hdc shell param get const.ohos.fullname
hdc shell param get const.ohos.apiversion
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
