A high-severity race condition vulnerability in OpenHarmony v5.0.3 and earlier versions allows local attackers to gain arbitrary code execution, posing a significant threat to system integrity.

This vulnerability is a race condition (CWE-362) within the Trusted Computing Base (tcb). Exploitation requires a local attacker with low privileges to leverage improper synchronization during concurrent execution to achieve arbitrary code execution.

Successful exploitation allows a local attacker to execute arbitrary code within the Trusted Computing Base, which is a highly privileged environment. Given the CVSS score of 8.4, this vulnerability represents a significant risk to the confidentiality and availability of the system. Unauthorized code execution at this level can lead to a complete compromise of the device security architecture.

Immediate Action: Review the official OpenHarmony security disclosure page for the latest patch releases and apply updates to versions beyond v5.0.3 as soon as they become available.

Proactive Monitoring: Monitor system logs for unusual process execution patterns or unexpected errors related to the Trusted Computing Base components.

Compensating Controls: Implement strict local access controls and ensure that only authorized users have the ability to execute code or interact with system-level interfaces on the device.

Public Exploit Available: No (exploit_available: false)

Due to the critical nature of the affected component, organizations using OpenHarmony must prioritize monitoring for vendor-supplied patches. Even though local access is required, the potential for arbitrary code execution in the Trusted Computing Base makes this a high-priority concern for system security. Apply updates immediately upon release to mitigate the risk of local escalation.