GhostMap Android Flaw Lets Malicious Apps Trigger Persistent Boot Loops
Summary
Bitdefender says GhostMap lets a permission-free Android app trigger repeated system crashes via a malformed APK. Google reportedly declined a fix as not reproducible; recovery may require a data-erasing factory reset or timely ADB access.
Key points
- Bitdefender says GhostMap arises because two Android libraries interpret ZIP compression methods differently, allowing a malformed APK to bypass size checks and map data beyond the file's contents.
- Reading the mapped region can cause a SIGBUS crash in the process that accesses it.
- A test app required no permissions, executable code, or launch; after installation, Android's system_server read a resource and repeatedly crashed.
- On a Pixel 10 running Android 17 with the August 5 security patch, researchers observed 110 crash-loop repetitions in normal mode and 72 in safe mode.
- Bitdefender says the loop can prevent access to Safe Mode. Recovery options are a factory reset, which erases local data, or deleting the malformed file through ADB if debugging is already enabled and action occurs before another crash.
- Bitdefender reports that Google marked the issue not reproducible and out of scope for a security update, while reserving it for possible consideration in a future update.
Article Details
- Vulnerability Types
- Denial of service causing a persistent boot loop
- Malformed APK causes a file to be mapped beyond its actual contents, triggering an invalid-memory-access crash
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- unavailable
- Workarounds
- Factory reset the device, which erases locally stored data.
- Delete the malformed file via ADB; debugging must already be enabled, and the scripts must act before the system crashes.