CVE-2018-19322: GIGABYTE Multiple Products Code Execution Vulnerability

Vulnerability summary

CVE-2018-19322 is a high (CVSS 7.8) Exposed Dangerous Method or Function vulnerability in GIGABYTE Multiple Products. It is known to be exploited: CISA lists it, first on 24-10-2022. It has been used in ransomware campaigns. EPSS estimates a 1.82% chance of exploitation in the next 30 days, higher than 78.5% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 21-12-2018
   PublishedVulnerability first disclosed.
2. 24-10-2022
   Added to CISA KEVGIGABYTE Multiple Products Code Execution Vulnerability
3. 14-11-2022
   CISA remediation dueApply updates per vendor instructions.
4. 13-08-2026
   Last modifiedVulnerability information updated.

Description

The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.

• CWE-749Exposed Dangerous Method or FunctionThe product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.