CVE-2018-19321
Published: October 24, 2022
Official Description
The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.
CISA KEV Advisory
GIGABYTE Multiple Products Privilege Escalation Vulnerability
The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.
Apply updates per vendor instructions.
Risk Analysis
This vulnerability affects GIGABYTE software drivers, allowing a local attacker to read and write arbitrary physical memory, which can lead to privilege escalation. The high EPSS score and confirmed exploitation by CISA indicate that this is a significant threat for systems running the affected GIGABYTE software.
This vulnerability has been actively exploited in the wild. Exploitation requires local access to the system, but successful exploitation can lead to full system compromise.
Users should update GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II to the latest versions that address this vulnerability. Restrict local user privileges to minimize the impact of potential exploitation.
Technical Analysis
CVE-2018-19321 requires local access, meaning attackers must already have a foothold on the target system.
Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
CISA has added CVE-2018-19321 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
Exploit & PoC Resources
All References (2)
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2018-19321 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1