Vulnerability Description
The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gigabyte | Aorus Graphics Engine | < 1.57 |
| Gigabyte | App Center | <= 1.05.21 |
| Gigabyte | Oc Guru Ii | 2.08 |
| Gigabyte | Xtreme Gaming Engine | < 1.26 |
Related Weaknesses (CWE)
References
- http://seclists.org/fulldisclosure/2018/Dec/39ExploitMailing ListThird Party Advisory
- http://www.securityfocus.com/bid/106252Broken LinkThird Party AdvisoryVDB Entry
- https://www.gigabyte.com/Support/Security/1801Vendor Advisory
- https://www.gigabyte.com/tw/Support/Utility/Graphics-CardProduct
- https://www.secureauth.com/labs/advisories/gigabyte-drivers-elevation-privilege-Broken LinkExploitThird Party Advisory
- http://seclists.org/fulldisclosure/2018/Dec/39ExploitMailing ListThird Party Advisory
- http://www.securityfocus.com/bid/106252Broken LinkThird Party AdvisoryVDB Entry
- https://www.gigabyte.com/Support/Security/1801Vendor Advisory
- https://www.gigabyte.com/tw/Support/Utility/Graphics-CardProduct
- https://www.secureauth.com/labs/advisories/gigabyte-drivers-elevation-privilege-Broken LinkExploitThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-US Government Resource
FAQ
What is CVE-2018-19322?
CVE-2018-19322 is a vulnerability with a CVSS score of 7.8 (HIGH). The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to re...
How severe is CVE-2018-19322?
CVE-2018-19322 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-19322?
Check the references section above for vendor advisories and patch information. Affected products include: Gigabyte Aorus Graphics Engine, Gigabyte App Center, Gigabyte Oc Guru Ii, Gigabyte Xtreme Gaming Engine.