Privilege Escalation Vulnerability in GIGABYTE Driver Software
CVE-2018-19321

7.8HIGH

Key Information:

Vendor

Gigabyte

Status
Oc Guru Ii
Aorus Graphics Engine
Xtreme Gaming Engine
App Center
Vendor
CVE Published:
21 December 2018

Badges

💰 Ransomware👾 Exploit Exists🟡 Public PoC🟣 EPSS 21%🦅 CISA Reported

What is CVE-2018-19321?

Low-level drivers in GIGABYTE APP Center and related software expose critical functions that allow reading and writing to arbitrary physical memory. This vulnerability enables local attackers to manipulate system memory and potentially gain elevated privileges, posing a significant security risk. Users are advised to update their software to the latest versions to mitigate this security exposure.

CISA has reported CVE-2018-19321

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2018-19321 as being exploited and is known by the CISA as enabling ransomware campaigns.

The CISA's recommendation is: Apply updates per vendor instructions.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

Driver-RW
Created by nanabingies

CVE-2018-19321
Created by nanabingies

References

http://seclists.org/fulldisclosure/2018/Dec/39
mailing-listx_refsource_FULLDISC
https://www.secureauth.com/labs/advisories/gigabyte-drive...
x_refsource_MISC
http://www.securityfocus.com/bid/106252
vdb-entryx_refsource_BID

EPSS Score

21% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 💰

    Used in Ransomware

  • 👾

    Exploit known to exist

  • 🦅

    CISA Reported

  • Vulnerability published

  • Vulnerability Reserved

.