high7.8Known exploited
CVE-2018-19321
GIGABYTE Multiple Products Privilege Escalation Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-10-24. Federal due date: 2022-11-14.
Apply updates per vendor instructions.
Impact
The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gigabyte | Aorus Graphics Engine | before 1.57 |
| Gigabyte | App Center | before 19.0422.1 |
| Gigabyte | Oc Guru Ii | Version 2.08 |
| Gigabyte | Xtreme Gaming Engine | before 1.26 |
References
- NVD record
- CVE.org record
- CISA KEV catalog
- http://seclists.org/fulldisclosure/2018/Dec/39
- http://www.securityfocus.com/bid/106252
- https://www.gigabyte.com/Support/Security/1801
- https://www.secureauth.com/labs/advisories/gigabyte-drivers-elevation-privilege-vulnerabilities
- http://seclists.org/fulldisclosure/2018/Dec/39
- http://www.securityfocus.com/bid/106252
- https://www.gigabyte.com/Support/Security/1801
- https://www.secureauth.com/labs/advisories/gigabyte-drivers-elevation-privilege-vulnerabilities
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-19321