CVE-2026-37525

{
  "id": "CVE-2026-37525",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-01T17:16:22.270",
  "lastModified": "2026-11-08T16:10:00.183",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "AGL app-framework-binder (afb-daemon) through v19.90.0 contains a privilege escalation vulnerability in the supervision Do command. The on_supervision_call function in src/afb-supervision.c explicitly nullifies the request credentials by calling afb_context_change_cred(&xreq->context, NULL) before dispatching an attacker-controlled API call via xapi->itf->call(xapi->closure, xreq). The NULL propagation chain through afb-context.c:110 (context->credentials = afb_cred_addref(NULL)) and afb-cred.c:163 (returns NULL when cred is NULL) confirms that credentials are zeroed before the target API executes. The attacker controls both api and verb parameters via JSON input, allowing execution of any registered API with a NULL credential context. APIs that rely on context->credentials for authorization decisions may fail open when receiving NULL credentials, enabling privilege escalation. This vulnerability was introduced in commit abbb4599f0b921c6f434b6bd02bcfb277eecf745 on 2018-02-14."
    },
    {
      "lang": "es",
      "value": "AGL app-framework-binder (afb-daemon) hasta la v19.90.0 contiene una vulnerabilidad de escalada de privilegios en el comando Do de supervisión. La función on_supervision_call en src/afb-supervision.c anula explícitamente las credenciales de la solicitud al llamar a afb_context_change_cred(&xreq  ->  context, NULL) antes de despachar una llamada a la API controlada por el atacante a través de xapi  ->  itf  ->  call(xapi  ->  closure, xreq). La cadena de propagación NULL a través de afb-context.c:110 (context  ->  credentials = afb_cred_addref(NULL)) y afb-cred.c:163 (devuelve NULL cuando cred es NULL) confirma que las credenciales se ponen a cero antes de que se ejecute la API objetivo. El atacante controla ambos parámetros, api y verb, a través de la entrada JSON, permitiendo la ejecución de cualquier API registrada con un contexto de credenciales NULL. Las API que dependen de context  ->  credentials para decisiones de autorización pueden fallar en modo abierto al recibir credenciales NULL, lo que permite la escalada de privilegios. Esta vulnerabilidad fue introducida en el commit abbb4599f0b921c6f434b6bd02bcfb277eecf745 el 14-02-2018."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-01T19:35:21.065832Z",
          "id": "CVE-2026-37525",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linuxfoundation:automotive_grade_linux:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "17.1.12",
              "matchCriteriaId": "F565A1E5-42E5-4115-830F-2A328C92F35B"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://gerrit.automotivelinux.org/gerrit/src/app-framework-binder",
      "source": "[email protected]",
      "tags": [
        "Broken Link"
      ]
    },
    {
      "url": "https://gist.github.com/sgInnora/8526eedcfd826d05ef1fc45d8f405643",
      "source": "[email protected]",
      "tags": [
        "Third Party Advisory"
      ]
    }
  ]
}