The Background service in Allwinner R818 SoC Android Q SDK V1.0 is used to manage…
Priority LOW 36Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
The Background service in Allwinner R818 SoC Android Q SDK V1.0 is used to manage background applications. Malicious apps can use the interface provided by the service to set the number of applications allowed to run in the background to 0 and add themselves to the whitelist, so that once other applications enter the background, they will be forcibly stopped by the system, causing a denial of service.
Why it matters now
EPSS 0.01677 77th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:allwinnertech:android_q_sdk:1.0:*:*:*:*:*:*:* | 1.0 | Vulnerable | Allwinnertech |
| cpe:2.3:h:allwinnertech:r818:*:*:*:*:*:*:*:* | all versions | Running on | Allwinnertech |
- cpe:2.3:a:allwinnertech:android_q_sdk:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Allwinnertech
- cpe:2.3:h:allwinnertech:r818:*:*:*:*:*:*:*:* Versions all versions Running on ·Allwinnertech
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-38788
- 2026-10-03 Alias added: GHSA-qc2p-7ph7-28gf
References
Advisory 4
More Allwinnertech Android Q Sdk vulnerabilities
- TI-2021-16313 There is an integer overflow in the ION driver "/dev/ion" of Allwinner R818 SoC Android Q… CVSS 3.1HIGH 7.5
- TI-2021-16312 There is a NULL pointer dereference in media/libcedarc/vdecoder of Allwinner R818 SoC… CVSS 3.1HIGH 7.5
- TI-2021-16311 There is a NULL pointer deference in the Allwinner R818 SoC Android Q SDK V1.0 camera… CVSS 3.1HIGH 7.5
- TI-2021-16310 There is a NULL pointer dereference in the syscall open_exec function of Allwinner R818… CVSS 3.1HIGH 7.5
- TI-2021-16309 There is a Out-of-Bound Write in the Allwinner R818 SoC Android Q SDK V1.0 camera driver… CVSS 3.1HIGH 7.5
- TI-2021-16315 Allwinner R818 SoC Android Q SDK V1.0 is affected by an incorrect access control… CVSS 3.1HIGH 7.5
Sources
- CVE-2021-38788 · CVE Program
- CVE-2021-38788 · NVD
- FIRST EPSS
- GHSA-qc2p-7ph7-28gf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences