CVE-2012-4220: Medium severity Google Android vulnerability

Published Nov 30, 2012

Updated

diagcharcore.c in the Qualcomm Innovation Center (QuIC) Diagnostics (aka DIAG) kernel-mode driver for Android 2.3 through 4.2 allows attackers to execute arbitrary code or cause a denial of service (incorrect pointer dereference) via an application that uses crafted arguments in a local diagcharioctl call.

Affected Software

23 affected components

Google Android=2.3

Google Android=2.3-rev1

Google Android=2.3.1

Google Android=2.3.2

Google Android=2.3.3

Google Android=2.3.4

Google Android=2.3.5

Google Android=2.3.6

Google Android=2.3.7

Google Android=3.0

Google Android=3.1

Google Android=3.2

Google Android=3.2.1

Google Android=3.2.2

Google Android=3.2.4

Google Android=3.2.6

Google Android=4.0

Google Android=4.0.1

Google Android=4.0.2

Google Android=4.0.3

Google Android=4.0.4

Google Android=4.1

Google Android=4.2

Event History

Nov 30, 2012

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2012-4220?

CVE-2012-4220 is classified as a critical vulnerability due to its potential for arbitrary code execution and denial of service.

How do I fix CVE-2012-4220?

To fix CVE-2012-4220, upgrade your Android operating system to a version higher than 4.2 that contains the patched DIAG kernel-mode driver.

What versions of Android are affected by CVE-2012-4220?

CVE-2012-4220 affects Android versions from 2.3 up to 4.2.

Can CVE-2012-4220 be exploited remotely?

CVE-2012-4220 requires local access to the device, making remote exploitation unlikely.

What vulnerabilities does CVE-2012-4220 address in the Qualcomm DIAG driver?

CVE-2012-4220 addresses issues in the Qualcomm DIAG kernel-mode driver that allow for incorrect pointer dereferencing.