GIGABYTE · Multiple Products
CVE-2018-19322
GIGABYTE Multiple Products Code Execution Vulnerability
What it is
The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.
CISA: The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: November 14, 2022
- Added to the CISA list
- October 24, 2022
- Published
- December 21, 2018
- Severity
- High 7.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 1.8% in the top 21.4% of all known vulnerabilities
- Weakness
- CWE-749
- More details
- NVD · CVE.org · CISA
All references (5)
More exploited flaws from GIGABYTE
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Oct 24, 2022 | Unspecified | Multiple Products | High 7.8 | 4.6% |
| Oct 24, 2022 | Privilege Escalation | Multiple Products | High 7.8 | 3.7% |
| Oct 24, 2022 | Privilege Escalation | Multiple Products | Critical 9.8 | 8.4% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.