CVE-2019-7630: gigabyte app_center Improper Initialization

Vulnerability summary

CVE-2019-7630 is a high (CVSS 9.0) Improper Initialization vulnerability in gigabyte app_center. EPSS estimates a 3.08% chance of exploitation in the next 30 days, higher than 87.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 25-03-2020
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

An issue was discovered in gdrv.sys in Gigabyte APP Center before 19.0227.1. The vulnerable driver exposes a wrmsr instruction via IOCTL 0xC3502580 and does not properly filter the target Model Specific Register (MSR). Allowing arbitrary MSR writes can lead to Ring-0 code execution and escalation of privileges.

• CWE-665Improper InitializationThe product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.