GhostMap Android Flaw: App Triggers Persistent Boot Loop

What GhostMap does to an Android phone

A specially crafted app can force an Android phone into a continuous boot loop. It requires no permissions and only needs to be installed, according to BleepingComputer's report.

Bitdefender named the flaw GhostMap. It makes Android map a file into an unallocated memory region. The affected process crashes when it tries to read from that region.

Bitdefender found it while analyzing an Android banking trojan. The trojan kept crashing the researchers' emulators when it tried to read an application resource.

Why the crash repeats on every restart

GhostMap comes from two Android libraries that interpret ZIP compression methods differently. A malformed APK (Android package file) can bypass size checks and be mapped beyond the file's actual contents.

Reading such an entry causes a SIGBUS in whichever process touches the file. A SIGBUS is a signal the CPU sends to stop a process that accesses invalid memory.

The demo app contains no executable code, requests no permissions and does not need to be launched. It carries a resource that the core Android service system_server automatically reads after installation. The read triggers the flaw and restarts the process. The process reads the same resource again and crashes again, in an endless loop.

Tested configuration and fix status

Bitdefender's test used the setup below. No fix has been released. The report covers only this tested configuration (Pixel 10, Android 17, August 5 patch) and does not list other affected devices or versions.

The 72 loops in the table matter. The crash loop continues in safe mode too, so Safe Mode is not a way out.

How serious it is

The demonstrated impact is a persistent denial of service. The phone becomes unusable.

The loop also blocks access to Safe Mode, which normally helps you troubleshoot and restore a device. There are two ways to stop the crashes:

• A factory reset, which erases all locally stored data.

• Deleting the malformed file via ADB.

The ADB route has limits. USB debugging must already be active on the device. The recovery scripts also have to act before the system crashes.

Google has known about GhostMap since August. Bitdefender reported it on August 20 and got a "Won't Fix (Not Reproducible)" reply, with the issue deemed out of scope. The researchers sent an extended version on August 25. Google still ruled it out of scope for a security update, though it reserved it for consideration in a future update. BleepingComputer has asked Google about the fix status, so check the original article for updates.

Bitdefender says the only chance to block the attack is during installation. Third-party security tools may detect a possible threat and show a warning. They do not have permission to block the installation.

What to do now

There is no patch to install. Your options are prevention and recovery planning.

1. Back up your data. A factory reset is one of the two recovery paths, and it wipes local storage.

2. Install apps only from sources you trust. The attack needs the app installed, so this is your main control.

3. Heed security tool warnings. Do not dismiss an install-time warning about an unknown app.

4. Decide on USB debugging for test devices. Active debugging is what makes ADB recovery possible. It also widens the attack surface, so weigh that for each device.

If you manage Android test phones, these standard ADB commands show the device state and what is installed:

adb devices
adb shell getprop ro.build.version.release
adb shell getprop ro.build.version.security_patch
adb shell pm list packages -3 -i

The last command lists third-party packages and the installer for each. Treat it as a preventive audit for managed or test fleets. It will not catch GhostMap on a phone that already has the app installed, because the crashes start about one second after install.

For a sideloaded APK you have not installed yet, the safest move is to not install it. If a device is already looping, uninstalling the package is one way to remove the file it carries, but Bitdefender has not confirmed this. The timing caveat still applies: the command must run before the system crashes.

adb uninstall <package.name>

Here is a quick decision table:

What IT and security learners can take from this

GhostMap shows how a parsing mismatch between two libraries can become a system-level crash. It also shows how a vendor's "not reproducible" label can leave users exposed. Reading research like Bitdefender's builds the habit of tracing a bug back to its root cause.

If you want hands-on practice with mobile app security, the EMAPT Mobile Application Penetration Tester voucher from INE costs $234.99 and arrives by email within 12 hours. You can also browse our Cybersecurity certifications to plan your next step.

Sources

• GhostMap Android flaw lets malicious app trigger persistent boot loop (BleepingComputer)