The vulnerability in AGL app-framework-binder (afb-daemon) through version 19.90.0 involves the on_supervision_call function explicitly setting the request credentials to NULL before invoking an attacker-controlled API call. This is done by calling afb_context_change_cred with a NULL parameter, which propagates through the codebase resulting in the credentials being zeroed out. Since the attacker controls the API and verb parameters via JSON input, they can execute any registered API with a NULL credential context. APIs that depend on context->credentials for authorization may fail open, enabling privilege escalation. This issue was introduced in a 2018 commit and has a CVSS 3.1 score of 7.8, indicating high impact on confidentiality, integrity, and availability with low attack complexity and no user interaction required.

An attacker with low privileges can escalate their privileges by invoking any registered API with a NULL credential context due to the credentials being explicitly nullified before the API call. This can lead to unauthorized access and potentially full compromise of the affected system's confidentiality, integrity, and availability. The vulnerability affects all versions of AGL app-framework-binder up to 19.90.0. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been provided in the available data. Until a patch is available, restrict access to the affected AGL app-framework-binder daemon and monitor for suspicious API calls that could exploit this vulnerability.