Critical Android Vulnerability Traps Devices in Endless Reboot Loop
Less than a week after Trend Micro disclosed a denial of service (DoS) vulnerability affecting a majority of Android devices on the market, researchers with the firm have uncovered yet another critical DoS flaw that plagues even more Android users.
The vulnerability can be exploited by an attacker forcing the phone to reboot, and is similar to the previously disclosed flaw that exists in the mediaserver program, Trend Micro’s mobile threat response engineer Wish Wu said in a blog post Tuesday.
“In more a severe case, where a related malicious app is set to auto-start, the device can be trapped in an endless reboot and rendered unusable,” Wu explained, adding that the bug can also drain the phone of its battery life.
An attacker can exploit the Android DoS vulnerability (CVE-2015-3823) in multiple ways, either by having a malicious app installed on the device, or by luring victims into visiting specially crafted malicious domains serving malformed media files.
“The vulnerability is caused by an integer overflow in parsing MKV files,” Wu explained. Triggering “the device to fall into an endless loop when reading video frames.”
The bug affects Android versions 4.0.1 and 5.1.1, meaning that roughly 89 percent of devices on the market today are vulnerable, Wu said, adding that attacks exploiting the bug have not yet been discovered in the wild. Trend Micro reported the vulnerability to Google, and the Android security team confirmed a patch was available.
“Getting rid of the app is quite problematic,” Wu said. “It may be difficult to locate the app once downloaded. Attackers may opt to keep it hidden and silent for a long time and only trigger the attack days or months later. Users may believe it is not installed and attribute the reboots to problems in the Android system.”
As Google has not yet patched the flaw, affected users can reboot their device in Safe Mode, which can be accessed by holding down the power button until a pop-up box appears asking you to restart in Safe Mode.
Once in Safe Mode, Android will disable all third-party apps and information, allowing you to continue using your Android device til Google patches the bug.
