Bitdefender has reported a vulnerability in Android that can trap smartphones in a crash loop, according to the source report. The company said it found the issue after an Android package (APK) it collected from the wild crashed emulators in its labs.
Bitdefender said the problem is not malware but a bug in the Android operating system. It described the flaw as a mishandling of two fields inside a ZIP entry: the compression method and the declared uncompressed length. Reading such an entry causes a SIGBUS signal in whichever process touches the file. The company named the issue GhostMap. In its explanation, the malformed entry causes Android to map the file across memory that was never allocated, and the crash occurs when a process reads from that empty space.
Bitdefender said the crash loop persists after a reboot and continues in safe mode. According to the report, the only way out is a factory reset, which erases all locally stored data.
The report says the bug affects Android 10 and later. It also says Google has so far not addressed the issue, claiming it falls outside the scope of a security fix. Bitdefender said it notified Google on August 20.
Bitdefender warned that cybercriminals could theoretically hide the technique in a fake app to disable a victim's phone, or use the threat of G