GhostMap Android vulnerability can trap phones in crash loops

An Android app without executable code and permissions can lock up a device, trapping it in an endless boot loop that even Safe Mode can’t stop. Users don’t even need to open the app, yet Google has refused to patch the flaw, Bitdefender says.

A dangerous new exploit, called GhostMap, has been revealed and attackers can exploit it to cause a persistent denial of service on all versions of Android since Android 10.

Simply installing a near-empty malicious app crashes the device, causing a permanent boot loop and requiring a factory reset that erases all data.

“Installing a specially crafted app can leave an Android phone stuck in a crash loop, even if you never open it or grant it a single permission,” Bitdefender Labs researchers warned in a new report.

The application presented does not even contain any executable code: the flaw occurs when Android fails to check the size of the application.

APK, the file format for an Android application, is essentially just a ZIP file, and Android mishandles two fields of it: the compression method and the declared uncompressed length.

“Reading such an entry causes a SIGBUS (a signal sent by the processor to stop a process that accesses an invalid memory space) regardless of which process touches the file,” Bitdefender researchers said.

The team tested the bug on a Pixel 10, running the latest Android 17 at the time, as well as older devices.

The bug was discovered in a suspicious malware sample linked to the banking sector: it crashed Android emulators. This was not an intended feature but rather an inadvertently introduced bug.

“This produces a repetitive crash loop…, with no way to go back except a factory reset,” Bitdefender warns.

“The file could not be deleted without ADB (Android Debug Bridge), even in safe mode, because the file manager processes crashed when trying to parse it.”

To use ADB, developer mode must be enabled before the crash.

Bitdefender Labs researchers said they disclosed the bug to Google twice in August. The first report was closed with the status “Will not be fixed (non-reproducible)”, while the second report was dismissed as “out of scope of a security update patch”.

Google told researchers that a fix could be included in a future version update. Cybernews has contacted Google for comment and will include its response.

Each file in ZIP archives (APK) provides two size values: the space it takes up in the archive and the space it would need when unarchived.

Two Android system libraries (libziparchive and libandroidfw) interpret ZIP compression labels differently, and an attacker can forge these values ​​in such a way that Android reads more data than the APK actually contains.

“Android doesn’t copy the entry into memory; it maps the file, asking the kernel to pop part of the file into memory. You can request a mapping larger than the file, and the kernel allows it because the extra space simply has nothing behind it,” the report explains.

Once Android tries to read past the end of the file, an error occurs and the kernel stops the process.

The researchers created an APK file that was only a few kilobytes in size, but mapped to 16MB of memory.

“The fault address arrives well after the end of the file, in the empty region corresponding to the claimed invented size. Reading left the file and the kernel stopped it,” the researchers said.

When an app installs on the system, many parts of Android may attempt to read its resources and crash due to malformed input.

A main system service loops through all installed apps and runs in system_server, the process that hosts most of Android.

It crashes, Android restarts it, and on restart the service goes through the installed apps again, reads the same file again, and crashes again. The phone never finished booting,

» we read in the report.

Hackers can exploit this flaw in several ways, targeting specific Android processes to crash them, rather than rendering the entire device unusable.

A malicious app could become impossible to remove by manipulating the value of its icon size: every screen that tries to access it, such as the app drawer or settings, would crash.

Security tools couldn’t scan the malicious app because it would crash.

An already installed app can later become malicious after an update, potentially affecting multiple devices at once.

Currently, no fixes are available and users have limited options to avoid such scenarios: avoid suspicious apps and keep Android software up to date. Security tools can detect malformed APKs when they reach the device, before they are installed.