Security experts have warned of a new vulnerability in Android smartphones which could plunge devices into a crash loop that can only be fixed by forcing a factory reset.
Bitdefender said it discovered the issue when an Android package (APK) it collected from the wild crashed the emulators in its labs. It found that the problem wasn’t malware, but a bug in the Android OS itself.
“The operating system mishandles two fields inside a ZIP entry, the compression method and the declared uncompressed length. Reading such an entry causes a SIGBUS (a signal sent by the CPU to stop a process that accesses an invalid memory space) in whichever process touches the file,” it explained in a blog post.
“We call it GhostMap: the malformed entry causes Android to map the file across memory that was never allocated, and the crash occurs when a process reads from that empty space.”
Read more on Android bugs: Google API Keys Quietly Gain Access to Gemini on Android Devices.
Bitdefender said that the crash loop persists after a reboot and continues in safe mode, meaning the only way out is a factory reset which erases all locally stored data.
The bug affects all Android versions from Android 10 and above, but Google has so far failed to address it, claiming the issue is outside the scope of a security fix, the report noted.
It was notified by the security vendor on August 20.
How Threat Actors Could Abuse GhostMap
Bitdefender warned that cybercriminals could theoretically hide the technique in a fake app to disable a victim’s phone, or use the threat of GhostMap as leverage for extortion.
It shared several possible scenarios:
- Brick a victim’s phone by first creating a malicious app containing a deliberately malformed resource that Android’s system service needs to read. When it does, the resource triggers a crash in system_server which renders the phone unusable. This could be used for extortion
- Make a malicious app impossible to remove. In this scenario an icon contains a malformed resource which triggers a crash when Android tries to display it. The launcher, the app list in Settings, and the app’s own info screen all crash when the user tries to access them to uninstall
- Disable security tools.Mobile security apps, malware-analysis sandboxes and automated scanning pipelines need to use Android’s resource-parsing code to examine suspect apps. By embedding a malformed resource in an APK, hackers could trigger GhostMap to crash anything inspecting it
- Delivery through an app update. An app looks trusted on download but, in theory, the malformed file could be introduced later. That would mean it could pass app-store checks and security scans to infect a much larger number of potential victims at once
“This is a flaw in Android itself and, as of publication, no fix is available, so users have limited options on the device to prevent it. The most practical defense is to recognize the file before the bug is triggered,” Bitdefender concluded.
“That’s possible because the malformation is visible in the file’s structure, without installing or running the app. A scanner can distinguish a crafted file from a normal one by inspecting it, not by executing it.”
The vendor detects this issue as Android.Riskware.Ghostmap.rA.
