CVE-2018-19320
GIGABYTE Multiple Products Unspecified Vulnerability
Description
CVE-2018-19320 is a high-severity vulnerability in the GDrv low-level kernel driver distributed with multiple GIGABYTE software products, including GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08. The GDrv driver exposes a ring-0 (kernel-level) memory copy operation — similar to memcpy — that can be invoked by any local user without privilege restrictions, allowing a local attacker to overwrite arbitrary kernel memory and take complete control of the affected system. CVE-2018-19320 has a CVSS score of 7.8 (HIGH) and is confirmed by CISA as actively exploited in the wild with associated ransomware activity, making it an urgent remediation priority for all affected Windows systems.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| gigabyte | aorus graphics engine | < 1.57 |
| gigabyte | app center | < 19.0422.1 |
| gigabyte | oc guru ii | 2.08 |
| gigabyte | xtreme gaming engine | < 1.26 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://seclists.org/fulldisclosure/2018/Dec/39(Exploit, Mailing List, Third Party Advisory)
- http://www.securityfocus.com/bid/106252(Broken Link, Third Party Advisory, VDB Entry)
- https://www.gigabyte.com/Support/Security/1801(Vendor Advisory)
- https://www.gigabyte.com/tw/Support/Utility/Graphics-Card(Product)
- https://www.secureauth.com/labs/advisories/gigabyte-drivers-elevation-privilege-vulnerabilities(Broken Link, Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-19320(US Government Resource)
Weakness Type
No CWE Assigned
CVE-2018-19320 does not carry a formal CWE classification in the NVD database. The vulnerability is best described as an exposed dangerous kernel interface: the GDrv driver provides a ring-0 memcpy-equivalent function accessible to unprivileged user-mode callers, effectively handing any local user a direct mechanism to copy arbitrary data into kernel memory space. This pattern is a fundamental driver security flaw — privileged kernel operations must never be exposed without strict access control validation.
Learn more: MITRE CWE — Common Weakness Enumeration
Impact Analysis
CVE-2018-19320 requires a local attacker with low-level user privileges, but the attack complexity is low and no user interaction is required, meaning any authenticated local user on a vulnerable system can achieve full system compromise. Confidentiality (High): Ring-0 memory access allows reading any kernel or process memory, exposing credentials, cryptographic keys, and other sensitive data. Integrity (High): The exposed memcpy-like kernel function allows writing arbitrary data to any kernel memory address, enabling reliable overwrite of security-critical structures such as process access tokens, kernel function pointers, and page table entries. Availability (High): Improper use of the kernel memory copy function can corrupt critical kernel data, triggering system crashes and extended unavailability. The EPSS score of 37.1% (97th percentile) signals very high real-world exploitation probability, and the CISA KEV listing with ransomware association confirms that threat actors actively exploit this class of GIGABYTE driver vulnerability in privilege escalation attack chains.
Exploit Maturity
Public exploit material for CVE-2018-19320 is available. A Full Disclosure mailing list post and a SecureAuth advisory detail the vulnerability and exploitation methodology across the GIGABYTE driver family, including the GDrv ring-0 memcpy exposure. CISA has confirmed active exploitation in the wild through the Known Exploited Vulnerabilities catalog, and this vulnerability is associated with ransomware campaigns. With an EPSS score of 37.1% (97th percentile), CVE-2018-19320 ranks among the most frequently exploited vulnerabilities in the NVD database. It is widely documented as a bring-your-own-vulnerable-driver (BYOVD) target, used by advanced threat actors to disable endpoint security products and achieve persistent kernel-level access.
Remediation
- Apply GIGABYTE vendor patches: Consult the GIGABYTE Security Advisory at gigabyte.com/Support/Security/1801 and update all affected products — GIGABYTE APP Center to above v1.05.21, AORUS GRAPHICS ENGINE to 1.57+, XTREME GAMING ENGINE to 1.26+, and OC GURU II to a version above v2.08.
- Uninstall unnecessary GIGABYTE utilities: If GIGABYTE APP Center or related tools are not required, remove them from all Windows endpoints to eliminate the vulnerable GDrv kernel driver entirely.
- Block the vulnerable GDrv driver hash: Use Windows Defender Application Control (WDAC) or the Microsoft recommended driver blocklist to prevent the vulnerable GDrv driver versions from loading, regardless of whether the parent software is uninstalled.
- Monitor for BYOVD exploitation patterns: Configure endpoint detection and response (EDR) solutions to alert on unauthorized kernel driver loads, ring-0 memory manipulation events, and other indicators consistent with bring-your-own-vulnerable-driver attacks.
- Apply kernel-level hardening: Enable Windows Hypervisor-Protected Code Integrity (HVCI) where supported, which prevents unsigned or vulnerable drivers from loading and substantially mitigates ring-0 memory exploitation risks.
Technical Details
CVE-2018-19320 is caused by the GDrv kernel-mode driver — part of GIGABYTE's hardware management software suite — exposing an IOCTL-accessible ring-0 memcpy-equivalent function to unprivileged user-mode callers. Ring-0 refers to the highest CPU privilege level (kernel mode), where code has unrestricted access to all system memory and hardware resources. The exposed function allows a user-mode process to specify source and destination memory addresses and trigger a kernel-level memory copy operation, effectively bypassing all operating system memory isolation and access control mechanisms. By supplying a target address corresponding to a kernel security structure — such as a process EPROCESS token field or a function pointer in a kernel module — an attacker can overwrite it with attacker-controlled data, achieving reliable local privilege escalation to SYSTEM. The CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms that while local access is required, exploitation is reliable and the impact is complete. This vulnerability follows the bring-your-own-vulnerable-driver (BYOVD) pattern extensively documented in threat intelligence reports on advanced persistent threat actors and ransomware groups.
Frequently Asked Questions
Is CVE-2018-19320 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2018-19320 through the Known Exploited Vulnerabilities catalog, with a remediation deadline of 2022-11-14 and confirmed ransomware association. The EPSS score of 37.1% (97th percentile) places this among the most actively exploited vulnerabilities across the entire CVE database.
What products are affected by CVE-2018-19320?
CVE-2018-19320 affects GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before version 1.57, XTREME GAMING ENGINE before version 1.26, and OC GURU II v2.08. The vulnerability is in the GDrv kernel driver installed by these utilities on Windows systems.
How do I fix CVE-2018-19320?
Update all affected GIGABYTE software to versions that include the security fix per the GIGABYTE vendor advisory. Where the software is not needed, remove it and block the vulnerable GDrv driver hash using WDAC or the Microsoft driver blocklist. Enable HVCI where supported for additional kernel protection. See the Remediation section for full details.
How severe is CVE-2018-19320?
CVE-2018-19320 carries a CVSS 3.1 score of 7.8 (HIGH), reflecting complete system compromise potential through ring-0 memory access. The EPSS percentile of 97.1% and CISA KEV listing with ransomware association make this an operationally critical vulnerability that requires immediate action, well beyond what the base CVSS score alone communicates.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.