Details are revealed and an exploit has been published for the vulnerability (CVE-2026-58882) in the Android platform, allowing for a looping reboot through a specially formatted SMS message. To eliminate the looping reboot, a factory reset or manual manipulation using the ADB utility is required. The vulnerability has been codenamed "SMS of Death" and was fixed in the October update for Android. The attack can be executed on any phones running Android 12-17. The update has only been released for Android 14-17. The exploit-triggering SMS message is processed in the background and does not appear on the device.
The problem is caused by an integer overflow when processing an incorrectly formatted WAP Push message header sent via SMS.
The overflow occurs because the header size field is cast to
a signed integer of type int without proper boundary checks, allowing for a negative number to be obtained in the variable headerLength. This variable is then used to allocate memory via the call "new byte[headerLength]", which, in the case of a negative number, leads to an exception and causes the com.android.phone process to crash.
After a few seconds, the process restarts, but the effect is not limited to a brief interruption of communication. The problematic WAP Push message continues to remain in the queue of unprocessed messages due to the crash, and another attempt to process it leads to another crash of the com.android.phone process.
After a series of such crashes, the RescueParty handler is triggered, which reboots the device into Recovery mode, where a factory reset is offered. A simple reboot does not helpāif the problematic message is not removed from the queue, in about 90 seconds the device will reboot again.
To remove the message from the queue without a factory reset, the adb utility is suggested:
adb shell content query --uri content://sms/raw --projection _id:destination_port:date:deleted
adb shell cmd appops set com.android.shell WRITE_SMS allow
adb shell "content delete --uri content://sms/raw --where \"address=''\""
adb shell cmd appops set com.android.shell WRITE_SMS default
adb shell pm clear com.android.providers.telephony
Maar dit zal alleen de mogelijkheid bieden om de SIM-kaart te verwijderen, op te starten en de firmware-update te installeren. Aangezien de operator van de mobiele diensten geen bevestiging over de verwerking van het WAP Push-bericht ontvangt door de nood beƫindiging van het proces 'com.android.phone', zal hij tot het verstrijken van de timeout blijven proberen het bericht opnieuw te verzenden en de situatie zal zich herhalen. In de uitgevoerde tests varieerde het aantal herhaalde verzendingen van een dag tot een week. Voor apparaten waarvan de fabrikanten zijn gestopt met het publiceren van firmware-updates, is er momenteel geen alternatieve manier om het probleem te verhelpen.
Bron: opennet.ru
