Security researchers at Bitdefender have revealed a serious security vulnerability in the Android operating system, which they have named "GhostMap". The danger of this vulnerability lies in the ability of a specially designed malicious application to put Android devices into a continuous boot loop, making the device unusable, without the need to grant the application any permissions or even run it after installation.
How Does the GhostMap Vulnerability Work?
The roots of the technical problem lie in a difference in how two Android libraries interpret ZIP file compression methods. This discrepancy allows malformed APK (Android application packages) files to bypass standard size checks, leading the system to attempt to map a file into an unallocated area of memory.
When the core system process system_server attempts to read this file, a SIGBUS error occurs (a signal sent by the processor to stop a process attempting to access invalid memory space). Since the system automatically attempts to restart the affected process, it re-reads the same malformed file and encounters the same error, creating an infinite crash loop. Experiments conducted by Bitdefender on a Pixel 10 device running Android 17 showed that the device begins to enter the crash loop just one second after the application is installed.
Google's Position on the Vulnerability
Despite the seriousness of the matter, Bitdefender faced difficulty in convincing Google to acknowledge the vulnerability; the giant company responded in August that the issue was "Not Reproducible" and was outside the scope of security updates. Although Bitdefender provided additional evidence, Google did not classify it as a priority for immediate fix, settling for placing it under consideration for future updates.
What Changes Practically for Users?
Since there is currently no official software patch available, facing this threat requires measures that may be costly or complex:
- Factory Reset: This is the most guaranteed solution, but it leads to erasing all data stored on the device.
- Using the ADB tool: The malformed file can be deleted via ADB commands, but this requires the "USB debugging" option to have been previously enabled, and the command must be executed extremely quickly before the system enters the crash loop.
Bitdefender indicates that the vulnerability even prevents users from accessing Safe Mode, making the traditional device recovery process extremely difficult. The only currently available means remains relying on external security tools that might detect suspicious applications during installation.