CVE-2018-19322
GIGABYTE Multiple Products Code Execution Vulnerability
Description
CVE-2018-19322 is a high-severity vulnerability affecting multiple GIGABYTE software products, including GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08. The GPCIDrv and GDrv low-level kernel drivers exposed by these applications allow any local user to read and write data from and to IO ports — hardware-level interfaces that control system devices — enabling privilege escalation to full system control. This vulnerability is classified under CWE-749 (Exposed Dangerous Method or Function) and carries a CVSS score of 7.8 (HIGH). CISA has confirmed active exploitation in the wild and the vulnerability is linked to ransomware activity, making CVE-2018-19322 a critical remediation target.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| gigabyte | aorus graphics engine | < 1.57 |
| gigabyte | app center | <= 1.05.21 |
| gigabyte | oc guru ii | 2.08 |
| gigabyte | xtreme gaming engine | < 1.26 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://seclists.org/fulldisclosure/2018/Dec/39(Exploit, Mailing List, Third Party Advisory)
- http://www.securityfocus.com/bid/106252(Broken Link, Third Party Advisory, VDB Entry)
- https://www.gigabyte.com/Support/Security/1801(Vendor Advisory)
- https://www.gigabyte.com/tw/Support/Utility/Graphics-Card(Product)
- https://www.secureauth.com/labs/advisories/gigabyte-drivers-elevation-privilege-vulnerabilities(Broken Link, Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-19322(US Government Resource)
Weakness Type
CWE-749: Exposed Dangerous Method or Function
CWE-749 describes situations where a software component exposes a method or function with dangerous capabilities that should be protected or restricted. In CVE-2018-19322, the GPCIDrv and GDrv kernel drivers expose IO port read/write operations without access control, allowing unprivileged user-mode processes to interact directly with hardware-level IO ports — a capability that should be restricted to privileged kernel code only.
Learn more: CWE-749 — Exposed Dangerous Method or Function
Impact Analysis
CVE-2018-19322 is locally exploitable and requires low-level privileges (any authenticated user), but the attack complexity is low and no user interaction is needed, making exploitation straightforward once local access is established. Confidentiality (High): Reading IO ports can expose sensitive hardware state information, including data from attached devices and internal system buses. Integrity (High): Writing to IO ports enables an attacker to manipulate hardware device behavior, reconfigure system components, and ultimately execute code with kernel-level privileges by targeting specific hardware interfaces. Availability (High): Malicious IO port writes can destabilize system hardware, cause device malfunctions, or trigger system crashes. The CVSS 3.1 score of 7.8 (HIGH) reflects the full confidentiality, integrity, and availability impact achievable through this exposed kernel driver interface. CISA's KEV catalog listing and confirmed ransomware association indicate that threat actors have actively leveraged this vulnerability class for privilege escalation and system compromise.
Exploit Maturity
Public exploit material for CVE-2018-19322 is available. A Full Disclosure mailing list post and a SecureAuth advisory document the vulnerability and exploitation methodology for the GIGABYTE GPCIDrv and GDrv drivers. CISA has confirmed active exploitation in the wild, with the KEV catalog entry linked to ransomware campaigns. The EPSS score of 2.9% (86th percentile) indicates that exploitation, while not yet at the highest frequency tier, is significantly more likely than for the average CVE. This vulnerability is commonly discussed in the context of bring-your-own-vulnerable-driver (BYOVD) techniques used by advanced threat actors to bypass endpoint security and escalate privileges to kernel level.
Remediation
- Apply GIGABYTE vendor patches: Follow the GIGABYTE Security Advisory at gigabyte.com/Support/Security/1801. Update GIGABYTE APP Center to a version above v1.05.21, AORUS GRAPHICS ENGINE to 1.57 or later, XTREME GAMING ENGINE to 1.26 or later, and OC GURU II beyond v2.08.
- Remove unused GIGABYTE utilities: If these overclocking or system management tools are not actively required, uninstall them to eliminate the vulnerable GPCIDrv and GDrv kernel drivers entirely.
- Block vulnerable driver hashes via WDAC: Use Windows Defender Application Control or the Microsoft recommended driver blocklist to prevent the vulnerable driver versions from loading, even if the software package remains installed.
- Monitor for IO port abuse and BYOVD indicators: Review endpoint detection logs for unauthorized driver load events, unexpected kernel module activity, and patterns consistent with bring-your-own-vulnerable-driver exploitation.
- Restrict driver installation to administrators: Enforce least-privilege policies to prevent non-admin users from installing kernel drivers, reducing the BYOVD attack surface and limiting exploitation of exposed dangerous driver interfaces.
Technical Details
CVE-2018-19322 exploits the GPCIDrv and GDrv kernel-mode drivers distributed with GIGABYTE's overclocking and hardware management software. These drivers expose IOCTL interfaces that allow user-mode processes to perform direct IO port read and write operations — functionality that is normally restricted to kernel-mode code operating at ring-0 privilege. IO ports are hardware-mapped interfaces used to communicate with system devices such as the PCI bus, storage controllers, and other peripherals; unrestricted access allows an attacker to manipulate hardware device state, inject data into device communication channels, and potentially execute code at kernel privilege by targeting specific IO port addresses associated with DMA-capable or code-execution-enabling hardware. CWE-749 captures this pattern precisely: the driver exposes a dangerous kernel capability (IO port access) as a callable function without enforcing any access control on callers. The CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects that while local access is required, exploitation is simple and results in full system impact.
Frequently Asked Questions
Is CVE-2018-19322 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2018-19322 through its Known Exploited Vulnerabilities catalog entry, with a remediation deadline of 2022-11-14. The vulnerability has been associated with ransomware activity and is used as part of bring-your-own-vulnerable-driver (BYOVD) techniques. The EPSS score of 2.9% (86th percentile) reflects meaningfully elevated exploitation probability.
What products are affected by CVE-2018-19322?
CVE-2018-19322 affects GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before version 1.57, XTREME GAMING ENGINE before version 1.26, and OC GURU II v2.08. The vulnerability is present in the GPCIDrv and GDrv kernel drivers installed by these utilities on Windows systems.
How do I fix CVE-2018-19322?
Update all affected GIGABYTE products to patched versions per the GIGABYTE security advisory. Alternatively, remove unused GIGABYTE utilities and block the vulnerable driver hashes using Windows Defender Application Control. Refer to the Remediation section for complete guidance.
How severe is CVE-2018-19322?
CVE-2018-19322 has a CVSS 3.1 score of 7.8 (HIGH), reflecting full confidentiality, integrity, and availability impact achievable through the exposed IO port interface. Combined with confirmed ransomware association in the CISA KEV catalog and an EPSS percentile of 86.1%, the operational risk is considerably higher than the base score alone suggests.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.