A specially crafted Android app can reportedly force a device into a persistent boot loop without requesting permissions or even being opened. Bitdefender researchers say the attack exploits a vulnerability they have named “GhostMap,” which causes Android to map file contents into unallocated memory and crash processes that attempt to read the affected area.
GhostMap can make an Android phone unusable
Romanian cybersecurity company Bitdefender identified the flaw while investigating an Android banking Trojan that repeatedly crashed an emulator when it tried to read application resources.
The researchers demonstrated the issue by creating an app with no executable code. The app requests no permissions during installation and does not need to be launched for the attack to occur.
Bitdefender says GhostMap results from two Android libraries interpreting ZIP compression methods differently. A malformed APK can exploit that discrepancy to bypass size checks and map data beyond the file’s actual contents.
“Reading such an entry causes a SIGBUS (a signal sent by the CPU to stop a process accessing invalid memory space) regardless of the process accessing the file,” the researchers said.
To demonstrate the boot-loop effect, Bitdefender created an app containing resources that the core Android service system_server automatically reads after installation. That read triggers the vulnerability, causing the service to crash and restart. When it reads the same resource again, it crashes once more, creating an endless cycle.
Researchers tested the attack on Pixel 10 devices running Android 17 with the August 5 security patch. The crash loop began about one second after the app was installed and repeated 110 times in normal boot mode and 72 times in safe mode.
Bitdefender warns that the resulting boot loop can prevent users from accessing Safe Mode, which would normally provide a way to troubleshoot the problem and recover the device.
Recovery may require a factory reset
According to Bitdefender, there are two ways to stop the crash loop. Users can perform a factory reset, which erases locally stored data, or delete the malformed files using Android Debug Bridge (ADB).
ADB recovery is subject to important limitations: USB debugging must already have been enabled on the device, and the recovery script must be able to run before the system crashes again.
Google classified the issue as unreproducible
Bitdefender reported GhostMap to Google on August 20th but received a “no fix (cannot reproduce it)” response. The issue was not included in security updates.
The researchers believed Google had misclassified the initial report and submitted an expanded version on August 25th. Google still considered the issue exempt from security updates but reserved it for possible consideration in a future update.
BleepingComputer contacted Google about the status of a GhostMap fix and was still awaiting a response.
Bitdefender says the main opportunity to stop an attack is during installation. Third-party security tools may detect suspicious applications and display warnings, the company said, but they cannot block installations.
Source: www.bleepingcomputer.com