Zero-Click Android DoS Vulnerability via Malformed WAP Push SMS
A critical telephony crash vulnerability enables remote, persistent denial of service on Android devices.
1Vulnerability Mechanism Explained
The flaw resides in WapPushOverSms.java, where a WSP header length is read as a long and cast to an int without bounds checking. This allows a malformed 5-byte uintvar to trigger a NegativeArraySizeException. Consequently, the telephony process crashes, effectively dropping all active calls, including critical emergency service connections.
2Zero-Click Remote Execution
This attack requires zero user interaction, as the malformed WAP Push message is delivered silently as a data SMS. The victim never sees an inbox notification or the sender's number. Testing across multiple models, including Pixel 9 and Samsung Galaxy series, confirms a 100% reproduction rate for this transient outage.
3Persistent Database Corruption
Rapidly sending approximately 30 payloads creates a race condition that corrupts the SQLite database responsible for storing SMS messages. Once corrupted, the telephony process fails during every boot cycle. This renders the device persistently unable to access cellular services, as the system crashes immediately upon attempting to read the damaged store.
4Hostile Recovery Challenges
Recovery is exceptionally difficult because a factory reset provides only temporary relief. Carriers often re-send the unacknowledged payload, immediately re-triggering the crash loop. For users with eSIMs, where physical SIM removal is impossible, the device becomes effectively bricked, requiring advanced technical intervention that remains largely inaccessible to the average consumer.
5Emergency Service Impact
The vulnerability directly prevents users from reaching emergency services like 000. By inducing a state where the device cannot place calls, the attack creates a public safety failure. This is not merely a software bug but a functional denial of access to essential infrastructure, posing significant risks to user safety.
6Regulatory Consequences and Barring
Australian regulations, specifically the Telecommunications Emergency Call Service Determination, mandate that carriers block devices unable to reach emergency services. Paradoxically, this vulnerability allows an attacker to force a carrier to bar the victim's device from the network. The regulatory remedy for a broken phone is network disconnection, not an OS patch.
7Google VRP Triage Failure
The vulnerability was reported through the Android Google Devices VRP, but Google classified it as a non-security issue across three separate tickets. Despite providing a clear fix involving a simple range check before the integer cast, the issue remained unaddressed beyond the 90-day disclosure window, necessitating public release of the findings.
8Security Research Implications
The public disclosure includes a proof-of-concept to assist OEMs and carriers in assessing risk. This case highlights the dangers of ignoring low-level telephony bugs that bypass user interaction. Security professionals must now account for persistent DoS vectors that exploit regulatory frameworks to effectively brick devices through forced network service barring.
Original article: Hacker News — Zero-Click Android DoS Vulnerability via Malformed WAP Push SMS