SMS of Death: Zero‑Click WAP‑Push Message Crashes Android Telephony Services, Blocking Calls and Emergency Calls
What Happened — Researchers have disclosed a flaw in Android’s WapPushOverSms component (found under frameworks/opt/telephony). By sending a specially crafted WAP‑Push SMS, an attacker can trigger an integer‑overflow in the decodeWapPdu() routine, causing a NegativeArraySizeException that crashes the com.android.phone process. The attack requires no user interaction – the malicious message is processed automatically by the OS – and can terminate the telephony stack, rendering the device unable to place or receive any calls, including emergency services. The proof‑of‑concept demonstrated that a five‑byte header can generate the value ‑2147483648, which is sufficient to crash the service.
Why It Matters for Trust & Control Assurance — The issue highlights the need for rigorous input‑validation controls and continuous vulnerability‑management evidence to satisfy multiple compliance frameworks with a single control objective.
Who Is Affected — Mobile device manufacturers, OEMs, and any organization that deploys Android smartphones to employees or customers (consumer, enterprise, telecom).
Recommended Actions
- Verify that your Android devices are running a version that includes the upstream fix (monitor vendor advisories).
- Deploy a mobile device management (MDM) policy that enforces timely OS updates and patches.
- Add runtime integrity checks for telephony services to detect and remediate unexpected crashes.
Technical Notes — The flaw resides in the decodeWapPdu() function, where a 64‑bit length field is cast to a 32‑bit integer without range checking, leading to a negative array size. The vulnerability is triggered via a WAP‑Push binary SMS (a “zero‑click” vector). No CVE has been assigned yet; the researcher has disclosed the details publicly. Source: SecurityAffairs article