New Android vulnerability, GhostMap, leaves smartphones stuck in an endless crash loop
Unrecoverable boot loop leaves a factory reset and complete data wipe as the only way out.
Android vulnerability. Image by Cybernews.
Follow us
- GhostMap bug can force Android phones into endless crash loops after users install a malicious app.
- The app needs no permissions, no executable code, and does not need to be opened.
- Bitdefender says the flaw affects Android 10 and later, and a factory reset may be required.
- Google has not issued a fix, so users should avoid suspicious apps and keep Android updated.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
An Android app with no executable code and no permissions can brick a device, trapping it in an endless boot loop that even safe mode can’t stop. Users don’t even need to open the app, yet Google has refused to fix the flaw, Bitdefender says.
A new, dangerous exploit, dubbed GhostMap, has been unveiled that attackers can leverage to cause persistent denial-of-service across all Android releases since Android 10.
Simply installing a nearly empty malicious app crashes the device, causing a permanent boot loop and requiring a factory reset that wipes all data.
“Installing a specially crafted app can leave an Android phone stuck in a crash loop, even if you never open it or grant it a single permission,” Bitdefender Labs researchers warned in a new report.
The demonstrated app doesn’t even contain any executable code – the flaw occurs when Android fails to check the size of the app.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
APK, an Android app’s file format, is essentially just a ZIP file, and Android mishandles two fields of it: the compression method and the declared uncompressed length.
“Reading such an entry causes a SIGBUS (a signal sent by the CPU to stop a process that accesses an invalid memory space) in whichever process touches the file,” the researchers at Bitdefender said.
The team tested the bug on a Pixel 10, running the latest Android 17 at the time, as well as older devices.
The bug was discovered in a suspicious banking-related malware sample – it was crashing Android emulators. It was not intended functionality but rather an inadvertently introduced bug.
“It produces the repeating crash loop ..., with no way back except a factory reset,” Bitdefender warns.
“The file couldn’t be deleted without ADB (Android Debug Bridge), not even in safe mode, because file-manager processes crashed when they tried to parse it.”
To use ADB, Developer Mode has to be enabled before the crash.
Bitdefender Labs researchers said they disclosed the bug to Google twice in August. The first report was closed with the status “Won’t Fix (Not Reproducible),” while the second report was dismissed as “outside the scope of a security update fix.”
Google told the researchers that a fix might be included in a future version update. Cybernews reached out to Google for a comment and will include their response.
How the crash happens
Every file in ZIP (APK) archives provides two size values: how much space it occupies within the archive, and how much space it would require when unarchived.
Two Android system libraries (libziparchive and libandroidfw) interpret ZIP compression labels differently, and an attacker can tamper with these values in a way that causes Android to read more data than the APK actually contains.
“Android doesn't copy the entry into memory; it maps the file, asking the kernel to make part of the file appear as memory. You can ask for a mapping larger than the file, and the kernel allows it because the extra space just has nothing behind it,” the report explains.
Once Android tries to read past the end of the file, a fault occurs, and the kernel kills the process.
Check if your data was exposed
Find out if your email and related personal information have appeared in known data breaches.
Researchers created an APK file that was only a few kilobytes in size but mapped to 16MB of memory.
“The fault address lands well past the end of the file, in the empty region the declared size invented. The read walked off the file, and the kernel stopped it,” the researchers said.
When an app installs on the system, many parts of Android might try to read its resources and crash on malformed entries.
A core system service iterates over all installed apps and runs inside system_server, the process that hosts most of Android.
It crashes, Android restarts it, and on restart the service goes through the installed apps again, reads the same file again, and crashes again. The phone never finishes starting,the report reads.
Hackers can exploit this flaw in several ways, targeting specific Android processes to crash, rather than rendering the entire device unusable.
A malicious app could be made impossible to remove by manipulating the size value of its icon – every screen that tries to access it, such as the app drawer or Settings, would crash.
Security tools couldn’t analyze the malicious app because they would crash.
An already installed app can turn malicious later after an update, potentially affecting many devices at once.
Currently, there is no fix available, and users have limited options to prevent such scenarios – avoid suspicious apps and keep Android software updated. Security tools can detect malformed APKs when they reach the device, before they’re installed.
