CVE-2018-19323 — CRITICAL (9.8)

Q: How severe is CVE-2018-19323?

CVE-2018-19323 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Q: Is there a patch for CVE-2018-19323?

Check the references section above for vendor advisories and patch information. Affected products include: Gigabyte Aorus Graphics Engine, Gigabyte Gigabyte App Center, Gigabyte Oc Guru Ii, Gigabyte Xtreme Gaming Engine.

Vulnerability Description

The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes functionality to read and write Machine Specific Registers (MSRs).

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Gigabyte	Aorus Graphics Engine	< 1.57
Gigabyte	Gigabyte App Center	<= 1.05.21
Gigabyte	Oc Guru Ii	2.08
Gigabyte	Xtreme Gaming Engine	< 1.26

References

http://seclists.org/fulldisclosure/2018/Dec/39ExploitMailing ListThird Party Advisory
http://www.securityfocus.com/bid/106252Broken LinkThird Party AdvisoryVDB Entry
https://www.gigabyte.com/Support/Security/1801Vendor Advisory
https://www.gigabyte.com/tw/Support/Utility/Graphics-CardProduct
https://www.secureauth.com/labs/advisories/gigabyte-drivers-elevation-privilege-Broken LinkExploitThird Party Advisory
http://seclists.org/fulldisclosure/2018/Dec/39ExploitMailing ListThird Party Advisory
http://www.securityfocus.com/bid/106252Broken LinkThird Party AdvisoryVDB Entry
https://www.gigabyte.com/Support/Security/1801Vendor Advisory
https://www.gigabyte.com/tw/Support/Utility/Graphics-CardProduct
https://www.secureauth.com/labs/advisories/gigabyte-drivers-elevation-privilege-Broken LinkExploitThird Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-US Government Resource

FAQ

What is CVE-2018-19323?

CVE-2018-19323 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes functionality to read and write...

How severe is CVE-2018-19323?

CVE-2018-19323 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2018-19323?

Check the references section above for vendor advisories and patch information. Affected products include: Gigabyte Aorus Graphics Engine, Gigabyte Gigabyte App Center, Gigabyte Oc Guru Ii, Gigabyte Xtreme Gaming Engine.