GIGABYTE · Multiple Products
CVE-2018-19320
GIGABYTE Multiple Products Unspecified Vulnerability
What it is
The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes ring0 memcpy-like functionality that could allow a local attacker to take complete control of the affected system.
CISA: The GDrv low-level driver in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II exposes ring0 memcpy-like functionality that could allow a local attacker to take complete control of the affected system.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: November 14, 2022
- Added to the CISA list
- October 24, 2022
- Published
- December 21, 2018
- Severity
- High 7.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 4.6% in the top 8.4% of all known vulnerabilities
- More details
- NVD · CVE.org · CISA
All references (5)
More exploited flaws from GIGABYTE
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Oct 24, 2022 | Privilege Escalation | Multiple Products | High 7.8 | 3.7% |
| Oct 24, 2022 | Code Execution | Multiple Products | High 7.8 | 1.8% |
| Oct 24, 2022 | Privilege Escalation | Multiple Products | Critical 9.8 | 8.4% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.