● Covered by 1 source · 1 reportMedium impact1 negative
GhostMap Android Flaw Allows Malicious App to Trigger Persistent Boot Loop
Key points
- GhostMap vulnerability causes Android devices to boot loop.
- Malicious app requires no permissions and no launch.
- Flaw exploits differing ZIP compression interpretations.
- Google has not patched the issue since August.
GhostMap Vulnerability Discovered
Cybersecurity company Bitdefender discovered a vulnerability in Android, named 'GhostMap', that allows attackers to force devices into a persistent boot loop. This denial-of-service (DoS) attack is triggered by a specially crafted application that requires no permissions and does not need to be launched by the user, only installed.
Technical Details of the Flaw
GhostMap arises from a discrepancy in how two Android libraries interpret ZIP compression methods. This difference enables a malformed Android Package Kit (APK) to bypass size checks, causing a file to be mapped into an unallocated memory region. When a process attempts to read from this invalid memory space, it crashes, generating a SIGBUS signal.
Bitdefender demonstrated this by creating an app with a resource that the core Android service 'system_server' automatically attempts to read post-installation. This read triggers the flaw, restarting the process, which then re-reads the resource and crashes again, creating an endless loop.
Impact on Devices
During tests on a Pixel 10 running Android 17 with the August 5 security patch, the device entered a crash loop approximately one second after app installation, repeating 110 times in normal boot mode and 72 times in safe mode. The boot loop prevents access to Safe Mode, which typically allows for troubleshooting. Recovery options are limited to a factory reset, which erases all data, or deleting the malformed file via ADB, which requires pre-activated debugging and quick action before system crashes.
Google's Response
Bitdefender reported the GhostMap flaw to Google in August. However, Google closed the issue without releasing a patch, stating it was "not reproducible."
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Reporting from
A vulnerability dubbed 'GhostMap' in Android allows a specially crafted, permission-less app to force devices into a continuous boot loop. This flaw, discovered by Bitdefender, stems from differing interpretations of ZIP compression methods in Android libraries, leading to memory access errors when a malformed APK is read. Google was informed in August but has not released a patch, classifying the issue as "not reproducible."