GIGABYTE · Multiple Products
CVE-2018-19323
GIGABYTE Multiple Products Privilege Escalation Vulnerability
What it is
The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes functionality to read and write Machine Specific Registers (MSRs).
CISA: The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: November 14, 2022
- Added to the CISA list
- October 24, 2022
- Published
- December 21, 2018
- Severity
- Critical 9.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 8.4% in the top 5.1% of all known vulnerabilities
- More details
- NVD · CVE.org · CISA
All references (5)
More exploited flaws from GIGABYTE
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Oct 24, 2022 | Unspecified | Multiple Products | High 7.8 | 4.6% |
| Oct 24, 2022 | Privilege Escalation | Multiple Products | High 7.8 | 3.7% |
| Oct 24, 2022 | Code Execution | Multiple Products | High 7.8 | 1.8% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.