CVE-2025-3012: Google Android DPC Modem DOS Vulnerability

CVE-2025-3012 Overview

CVE-2025-3012 is a high-severity null pointer dereference vulnerability affecting the DPC modem component in Google Android devices running on Unisoc chipsets. The vulnerability exists due to improper handling of pointers in the modem firmware, which can lead to a system crash when exploited. This could enable remote denial of service attacks without requiring any additional execution privileges or user interaction.

Critical Impact

Remote attackers can trigger a system crash on affected Android devices with Unisoc chipsets via network-based attacks, causing denial of service without any authentication or user interaction required.

Affected Products

• Google Android 13.0, 14.0, 15.0, and 16.0
• Unisoc T8100 chipset
• Unisoc T8200 chipset
• Unisoc T8300 chipset
• Unisoc T9100 chipset

Discovery Timeline

• 2025-12-01 - CVE-2025-3012 published to NVD
• 2025-12-02 - Last updated in NVD database

Technical Details for CVE-2025-3012

Vulnerability Analysis

This vulnerability is classified as a null pointer dereference issue within the DPC (Data Protocol Controller) modem component. The CVSS 3.1 score of 7.5 (High) reflects the severity of this vulnerability, with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H indicating:

• Attack Vector (AV:N): Network-accessible, meaning the vulnerability can be exploited remotely
• Attack Complexity (AC:L): Low complexity required for exploitation
• Privileges Required (PR:N): No authentication or privileges needed
• User Interaction (UI:N): No user interaction required
• Impact: High availability impact with no confidentiality or integrity impact

The EPSS (Exploit Prediction Scoring System) data shows a probability of 0.153% with a percentile ranking of 36.6, suggesting moderate likelihood of exploitation in the wild.

Root Cause

The root cause of CVE-2025-3012 lies in insufficient validation of pointer references within the DPC modem firmware. When processing certain network data, the modem component fails to verify that a pointer is valid before dereferencing it. This missing null check allows crafted network traffic to trigger a condition where the code attempts to access memory through an invalid (null) pointer, resulting in a system crash.

The vulnerability affects the modem's data processing pipeline, which handles network communications at a low level on Unisoc-based Android devices. The lack of proper input validation in this critical component creates an exploitable condition that can be triggered remotely.

Attack Vector

The attack vector for CVE-2025-3012 is network-based, allowing remote exploitation without physical access to the target device. An attacker can craft malicious network packets designed to trigger the null pointer dereference condition in the DPC modem component.

The exploitation scenario involves sending specially crafted data over the network to a vulnerable Android device with an affected Unisoc chipset. When the modem processes this malicious input, it encounters the null pointer condition, causing the modem firmware to crash and potentially leading to a complete system crash or reboot. This denial of service attack can be repeated to persistently disrupt device availability.

Detection Methods for CVE-2025-3012

Indicators of Compromise

• Unexpected device reboots or crashes without apparent cause
• Modem subsystem crashes visible in system logs
• Repeated network connection failures or instability
• System log entries indicating null pointer exceptions in modem-related processes
• Abnormal network traffic patterns targeting the device's modem stack

Detection Strategies

Organizations should implement network-level monitoring to detect potential exploitation attempts targeting this vulnerability. Security teams can leverage endpoint detection and response (EDR) solutions to monitor for:

1. Crash Analysis: Monitor for kernel panic events or modem subsystem crashes that may indicate exploitation attempts
2. Network Traffic Analysis: Inspect incoming network traffic for anomalous patterns that could indicate crafted packets targeting the modem stack
3. Log Correlation: Correlate device crash events with network activity to identify potential attack patterns
4. Behavioral Monitoring: Track device stability metrics to identify devices experiencing unusual crash frequencies

SentinelOne Singularity Platform provides comprehensive endpoint protection that can detect anomalous system behavior and crash patterns indicative of denial of service attacks targeting mobile device firmware.

Monitoring Recommendations

Security teams should configure logging and alerting for the following:

• Enable verbose logging for modem-related system services
• Monitor crash dump directories for modem-related crash reports
• Set up alerts for devices experiencing repeated unexpected reboots
• Implement network intrusion detection rules to identify potential exploitation traffic
• Track firmware versions across device fleet to identify vulnerable endpoints

How to Mitigate CVE-2025-3012

Immediate Actions Required

• Review and inventory all Android devices with Unisoc T8100, T8200, T8300, or T9100 chipsets
• Apply the latest security patches from Unisoc as outlined in their security advisory
• Prioritize patching for devices exposed to untrusted networks
• Consider network segmentation to limit exposure of vulnerable devices
• Monitor affected devices for signs of exploitation or unusual crashes

Patch Information

Unisoc has released a security advisory addressing this vulnerability. Administrators and device manufacturers should review the vendor advisory at:

• Vendor Advisory: https://www.unisoc.com/en/support/announcement/1995394837938163714

Organizations should coordinate with their device vendors to obtain and deploy firmware updates that address this null pointer dereference vulnerability. For Android devices, security patches are typically distributed through the monthly Android Security Bulletin process or via device manufacturer updates.

Workarounds

While awaiting patch deployment, organizations can implement the following temporary mitigations:

1. Network Filtering: Deploy network-level filtering to inspect and potentially block malicious traffic targeting the modem stack, though specific packet signatures may not be publicly available

2. Device Monitoring: Implement enhanced monitoring on affected devices to quickly identify and respond to exploitation attempts

3. Network Isolation: Where possible, limit network exposure of critical devices running vulnerable firmware versions

4. Accelerated Patching: Prioritize obtaining and deploying vendor firmware updates for devices in high-risk environments

Note that as this vulnerability exists in the modem firmware, software-only workarounds may have limited effectiveness. The recommended mitigation is to apply vendor-provided firmware updates as soon as they become available.