GhostMap Android flaw lets installed app force a boot loop
Original title: GhostMap Android flaw lets malicious app trigger persistent boot loop
Bitdefender’s no-permission demo crashed a Pixel 10 on Android 17; Google closed the report without a patch.
Bitdefender says a flaw it calls GhostMap lets a specially crafted Android app, needing no permissions and no launch, map a file into unallocated memory and crash the process that reads it. A resource read by system_server after installation restarted that service in a loop, including in safe mode, on a Pixel 10 running Android 17 with the August 5 security patch. Google told Bitdefender on reports from August 20 and August 25 that the issue was not reproducible and out of scope for a security update. Recovery is a factory reset or deleting the file over ADB if debugging is already enabled.
Unconfirmed: Google classified the report as not reproducible and out of scope; Bitdefender says that assessment was wrong, and no fix status was confirmed.
- The demo app contained no executable code and did not need to be opened.
- On the test phone the loop ran 110 times in normal boot and 72 times in safe mode.
- Two ZIP libraries disagree on compression methods, letting a malformed APK pass size checks.
- Bitdefender found the behavior while a banking trojan crashed its emulators.
- Third-party tools may warn at install but cannot block installation.
Impact: Persistent boot-loop denial of service after app installation
| Product | Affected |
|---|---|
| Google Android | Demonstrated on Pixel 10 running Android 17 with the August 5 security patch |
- 1.Factory-reset the device, or delete the malformed file over ADB if USB debugging is already on.
- 2.Treat installation as the only chance to stop the app; security tools cannot block it.
- Vendors
- Products
- Android
- Organizations
- Bitdefender
From the original article
2 min read at bleepingcomputer.com
Attackers can force Android devices into a continuous boot loop using a specially crafted app that requires no permissions and only needs to be installed. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.