Cybersecurity researchers have disclosed a flaw named “GhostMap” that enables malicious applications to trigger persistent boot loops on Android devices, effectively “bricking” the hardware. The vulnerability, which affects Android versions 10 through 17, reportedly requires no special system permissions and does not require the user to manually launch the app after installation to execute the crash.
Despite the severity of the impact, Google has declined to issue a security patch for the flaw. The company classified the bug as “Won’t Fix” and “Not Reproducible,” suggesting it does not meet the criteria for a security vulnerability. Consequently, no CVE identifier has been assigned to the issue.
The ZIP Library Mismatch
The GhostMap exploit leverages a technical discrepancy between two internal Android libraries responsible for handling ZIP compression within APK files. According to technical analysis by Bitdefender, the conflict arises during the memory-mapping process. One library is designed to check the size of entries only when they are explicitly marked as “stored” (uncompressed). However, a second library treats any entry not specifically marked as “deflated” as a “stored” entry.
This inconsistency allows a crafted APK to bypass standard size checks. When the Android kernel attempts to read from these incorrectly mapped memory locations, it triggers a SIGBUS signal. This signal indicates that the process is trying to access memory that the hardware cannot physically address or that has not been properly allocated, leading to an immediate crash of the system.
Ineffectiveness of Safe Mode
A critical aspect of GhostMap is its persistence. Unlike many malicious apps that can be neutralized by booting into Safe Mode, GhostMap remains active. This is because the crash occurs within the “system_server” process—a core component of the Android operating system.
Since “system_server” is required for the device to function even in restricted environments, the crash loop persists during every boot attempt. Because the exploit is triggered by the system’s own attempt to parse the installed application’s metadata, researchers note that a full factory reset is typically the only reliable method to recover a device once the boot loop has started.
Risk Mitigation and Sideloading
Because Google has categorized this as a non-security issue, it was omitted from official security bulletins. This leaves the responsibility for protection largely on the user. The primary vector for a GhostMap attack is the installation of APK files from third-party sources or untrusted websites.
Standard security features like Google Play Protect are intended to flag known malicious patterns, but the “unpatchable” nature of the underlying library conflict means that any new application utilizing this ZIP structure could bypass signature-based detection. Security experts recommend that users avoid sideloading applications from unknown developers, as there are currently no known third-party tools or ADB commands that can halt the “system_server” crash without wiping device data.
