A vulnerability that Bitdefender calls GhostMap can force Android devices into a continuous boot loop with a specially crafted app. The app needs no permissions and only has to be installed on the device.
GhostMap and the malformed APK
Romanian cybersecurity company Bitdefender traced the flaw while examining an Android banking trojan that kept crashing its emulators when it tried to read an application resource. The company showed that a malicious app with no executable code, no installation permissions, and no need to be launched could still trigger the problem.
In Bitdefender’s account, GhostMap comes from two Android libraries that handle ZIP compression methods in different ways. That mismatch lets a malformed APK, or Android package file, pass size checks and get mapped past the file’s real contents. When a process reads that entry, it hits a SIGBUS, which stops the process when it touches invalid memory space.
The researchers said Google had known about GhostMap since August, but closed the issue without a patch and marked it as not reproducible. Google later received an extended report on August 25, and Bitdefender believed the original report had been misclassified.
Crash loop after installation
Bitdefender built an app that included a resource the Android core service system_server automatically tries to read after installation. That read triggers the flaw, restarts the process, and sends it back to the same resource, where it crashes again. In the company’s tests on a Pixel 10 running Android 17 with the August 5 security patch, the crash string began about one second after installation. The loop ran 110 times in normal boot mode and 72 times in safe mode.
The boot loop also blocks access to Safe Mode, which would normally help with troubleshooting and device recovery. Bitdefender said the issue can be stopped either with a factory reset that wipes locally stored data or by deleting the malformed file through ADB. ADB only works if debugging was already enabled on the device, and the restoration script has to act before the system crashes.
Google’s handling of the report
Bitdefender reported the issue to Google on August 20 and received a “Won’t Fix (Not Reproducible)” response, with the issue treated as out of scope. After the extended submission on August 25, Google still considered it out of scope for a security update, but reserved it for possible inclusion in a future update.
Bitdefender said the attack can only be blocked during installation. The company added that third-party security tools may detect a possible threat and warn about it, but they do not have permission to block the installation.
Licensed under CC BY-ND 4.0 International