Affected Systems
Android devices running Android 17 with August 5, 2024 security patch confirmed vulnerable (tested on Pixel 10). Likely affects broader range of Android versions and devices. Vulnerability stems from ZIP compression handling discrepancy between two Android libraries.
Exploitation Status
Proof-of-concept demonstrated by Bitdefender researchers. No active exploitation reported in the wild. Attack requires installation of specially crafted APK with malformed resource file. No permissions required and app does not need to be launched.
Business Impact
Malicious app causes immediate and persistent denial of service by crashing system_server process in endless loop (110+ crashes in normal mode, 72+ in safe mode). Safe Mode is inaccessible, leaving only factory reset (data loss) or ADB recovery (requires pre-enabled debugging and fast action) as remediation options. Google closed the report as "not reproducible" and "out of scope" with no patch planned as of November 2024. Enterprise MDM and app vetting processes are primary defense.
Urgency
🟡 Within a week
Recommended Actions
- Enforce strict app installation policies via MDM: block sideloading and restrict installations to vetted app stores only
- Enable USB debugging on corporate Android devices and document ADB recovery procedures for IT staff
- Deploy third-party mobile threat defense solutions capable of scanning APK files for malformed ZIP structures during installation
- Monitor Google Android Security Bulletins for future patches addressing GhostMap (no CVE assigned yet)
- Educate users on risks of installing apps from untrusted sources and phishing campaigns delivering malicious APKs