- GhostMap bug can force Android phones into endless crash loops after users install a malicious app.
- The app needs no permissions, no executable code, and does not need to be opened.
- Bitdefender says the flaw affects Android 10 and later, and a factory reset may be required.
- Google has not issued a fix, so users should avoid suspicious apps and keep Android updated.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
An Android app with no executable code and no permissions can brick a device, trapping it in an endless boot loop that even safe mode can’t stop. Users don’t even need to open the app, yet Google has refused to fix the flaw, Bitdefender says.
A new, dangerous exploit, dubbed GhostMap, has been unveiled that attackers can leverage to cause persistent denial-of-service across all Android releases since Android 10.
Simply installing a nearly empty malicious app crashes the device, causing a permanent boot loop and requiring a factory reset that wipes all data.
“Installing a specially crafted app can leave an Android phone stuck in a crash loop, even if you never open it or grant it a single permission,” Bitdefender Labs researchers warned in a new report.
The demonstrated app doesn’t even contain any executable code – the flaw occurs when Android fails to check the size of the app.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
APK, an Android app’s file format, is essentially just a ZIP file, and Android mishandles two fields of it: the compression method and the declared uncompressed length.
“Reading such an entry causes a SIGBUS (a signal sent by the CPU to stop a process that accesses an invalid memory space) in whichever process touches the file,” the researchers at Bitdefender said.
The team tested the bug on a Pixel 10, running the latest Android 17 at the time, as well as older devices.
The bug was discovered in a suspicious banking-related malware sample – it was crashing Android emulators. It was not intended functionality but rather an inadvertently introduced bug.
“It produces the repeating crash loop …, with no way back except a factory reset,” Bitdefender warns.
“The file couldn’t be deleted without ADB (Android Debug Bridge), not even in safe mode, because file-manager processes crashed when they tried to parse it.”
To use ADB, Developer Mode has to be enabled before the crash.
Bitdefender Labs researchers said they disclosed the bug to Google twice in August. The first report was closed with the status “Won’t Fix (Not Reproducible),” while the second report was dismissed as “outside the scope of a security update fix.”
Google told the researchers that a fix might be included in a future version update. Cybernews reached out to Google for a comment and will include their response.
How the crash happens
Every file in ZIP (APK) archives provides two size values: how much space it occupies within the archive, and how much space it would require when unarchived.
Two Android system libraries (libziparchive and libandroidfw) interpret ZIP compression labels differently, and an attacker can tamper with these values in a way that causes Android to read more data than the APK actually contains.
“Android doesn’t copy the entry into memory; it maps the file, asking the kernel to make part of the file appear as memory. You can ask for a mapping larger than the file, and the kernel allows it because the extra space just has nothing behind it,” the report explains.
Once Android tries to read past the end of the file, a fault occurs, and the kernel kills the process.
You don’t have to keep an eye on this by yourself. Here’s what’s included:
- 24/7 dark web monitoring
- Credit and financial alerts
- Automatic data removal
16% off
$10.42/month
Set up protection
We may earn a commission if you buy through the link below.
*Insurance covers losses from misuse of your data after your plan starts. It doesn’t cover past breaches, including the ones shown above.
