GhostMap Android flaw lets malicious apps trigger persistent boot loops

A vulnerability in Android, dubbed GhostMap by researchers, can let a specially crafted app repeatedly crash a core system process and trigger a persistent boot loop. The app needs no permissions and does not have to be opened after installation.

Romanian cybersecurity company Bitdefender found the flaw while investigating an Android banking trojan that crashed its emulators. The company says two Android libraries interpret ZIP compression methods differently. A malformed Android package (APK) can exploit that mismatch to bypass size checks and map a file beyond its contents. Reading the file then causes an invalid-memory-access signal, researchers say.

Bitdefender demonstrated the issue with an app whose resource the system_server process automatically reads after installation. That read triggers a crash and restart, after which the process reads the same resource again. In tests on a Pixel 10 running Android 17 with the August 5 security patch, the crash loop began about one second after installation and repeated 110 times in normal boot mode and 72 times in safe mode. Bitdefender says the loop can also prevent access to Safe Mode.

Google has been aware of the issue since August, according to Bitdefender. The company says it reported the flaw on August 20 and received a “Won’t Fix (Not Reproducible)” response. After submitting an expanded report on August 25, Bitdefender says Google still considered the flaw out of scope for a security update, while reserving it for possible consideration in a future update. BleepingComputer says it has asked Google about the fix status and is awaiting a reply.

Bitdefender says the attack can only be blocked during installation. It says recovery may require a factory reset, which erases locally stored data, or deleting the malformed file with ADB if debugging is already enabled and the process can finish before another crash.