GhostMap Android flaw lets malicious app trigger persistent boot loop

Attackers can force Android devices into a continuous boot loop using a specially crafted app that requires no permissions and only needs to be installed.

To cause the persistent denial-of-service (DoS), the app triggers a vulnerability that researchers dubbed 'GhostMap' that makes Android map a file into an unallocated memory region. The affected process crashes when it attempts to read from that region.

Romanian cybersecurity company Bitdefender discovered the flaw while analyzing an Android banking trojan that kept crashing its emulators when it tried to read an application resource.

The researchers demonstrated the vulnerability by creating an app that contains no executable code, requests no permissions on installation, and does not need to be launched on the device.

According to the company, Google has been aware of GhostMap since August but closed the issue without releasing a patch, classifying it as "not reproducible."

Making phones unusable

In a report today, Bitdefender explains that GhostMap stems from two Android libraries that interpret ZIP compression methods differently. This allows a malformed APK (Android package file) to bypass size checks and be mapped beyond the file’s actual contents.

"Reading such an entry causes a SIGBUS (a signal sent by the CPU to stop a process that accesses an invalid memory space) in whichever process touches the file," the researchers say.

To demonstrate the crash-loop effect, Bitdefender created an app containing a resource that the core Android service ‘system_server’ automatically attempts to read after installation.

The read triggers the flaw and restarts the process, causing it to read the same resource and crash again in an endless loop.

During the tests, the researchers used a Pixel 10 device running Android 17 with the August 5 security patch. The device started the crash string about one second after installing the app, the loop repeating for 110 times in normal boot mode and 72 times in safe mode.

Bitdefender warns that the boot loop also prevents users from accessing Safe Mode, which would normally provide a way to troubleshoot the problem and restore the device.

Stopping the crashes is possible in two ways: a factory reset, which erases all locally stored data, and by deleting the malformed file via ADB.

However, using ADB requires the debugging option to already be active on the device. Additionally, restoring via ADB requires the scripts to act before the system crashes.

Google’s response

Bitdefender reported the issue to Google on August 20, but received a “Won’t Fix (Not Reproducible)” reply, with the issue being out of scope.

The researchers submitted an extended version on August 25, believing Google misclassified the original report. The tech giant still deemed it out of scope for a security update, though it reserved it for consideration in a future update.

BleepingComputer has reached out to Google asking about the fix status for GhostMap, but we are still waiting for a reply.

Bitdefender says the only chance to block the attack is during installation, noting that third-party security tools may help detect a possible threat and display a warning, but do not have permission to block installation.