CVE-2018-19323
GIGABYTE Multiple Products Privilege Escalation Vulnerability
Description
CVE-2018-19323 is a critical vulnerability in the GDrv low-level kernel driver shipped with multiple GIGABYTE software products, including GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08. The vulnerable driver exposes unrestricted read and write access to Machine Specific Registers (MSRs) to any local user, allowing a low-privileged attacker to manipulate CPU-level configuration and potentially execute arbitrary code with ring-0 (kernel) privileges. CVE-2018-19323 carries a CVSS score of 9.8 (CRITICAL) and is listed in CISA's Known Exploited Vulnerabilities catalog with confirmed ransomware association, making it an urgent patching priority for any organization running affected GIGABYTE software.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| gigabyte | aorus graphics engine | < 1.57 |
| gigabyte | gigabyte app center | <= 1.05.21 |
| gigabyte | oc guru ii | 2.08 |
| gigabyte | xtreme gaming engine | < 1.26 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://seclists.org/fulldisclosure/2018/Dec/39(Exploit, Mailing List, Third Party Advisory)
- http://www.securityfocus.com/bid/106252(Broken Link, Third Party Advisory, VDB Entry)
- https://www.gigabyte.com/Support/Security/1801(Vendor Advisory)
- https://www.gigabyte.com/tw/Support/Utility/Graphics-Card(Product)
- https://www.secureauth.com/labs/advisories/gigabyte-drivers-elevation-privilege-vulnerabilities(Broken Link, Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-19323(US Government Resource)
Weakness Type
No CWE Assigned
CVE-2018-19323 does not have a formal CWE classification in the NVD database. The vulnerability is best described as an exposed dangerous kernel driver interface: the GDrv driver provides kernel-level MSR read/write access without enforcing any access controls, effectively creating a privileged escape path for any local process. This class of vulnerability — where hardware abstraction drivers expose privileged ring-0 operations to unprivileged user-mode callers — is well recognized in the security community as a systemic risk in third-party OEM tooling.
Learn more: MITRE CWE — Common Weakness Enumeration
Impact Analysis
Despite having a local attack vector, CVE-2018-19323 is rated CRITICAL (CVSS 9.8) due to the severity of what MSR access enables. Attack Vector (Network): The CVSS rating uses a network attack vector reflecting how exposed systems — or those with MSR access exposed via another vector — can be exploited without physical access. Privileges Required (None): No authentication or elevated privileges are needed to interact with the driver interface. User Interaction (None): Exploitation is fully automated and requires no victim action. Confidentiality (High): Reading MSRs can expose sensitive CPU state and cryptographic material. Integrity (High): Writing to MSRs allows attackers to alter CPU behavior, disable security features such as SMEP/SMAP, and facilitate kernel code execution. Availability (High): Corrupting CPU state or kernel structures can cause system crashes or render systems inoperable. The EPSS score of 14.7% (94th percentile) and confirmed ransomware use in the KEV catalog underline that active exploitation of this class of vulnerability is ongoing.
Exploit Maturity
Public exploit code and proof-of-concept material for CVE-2018-19323 are available. A Full Disclosure mailing list post and a SecureAuth advisory document the vulnerability details and exploitation approach for the GIGABYTE driver family. CISA has confirmed active exploitation in the wild by including CVE-2018-19323 in its Known Exploited Vulnerabilities catalog, and the vulnerability has been linked to ransomware operations. The EPSS score of 14.7% (94th percentile) indicates substantially elevated exploitation probability compared to the broader CVE population. Threat actors have leveraged vulnerable GIGABYTE drivers as a bring-your-own-vulnerable-driver (BYOVD) technique to disable security products and achieve kernel-level persistence.
Remediation
- Apply GIGABYTE vendor mitigations immediately: Follow GIGABYTE Security Advisory at gigabyte.com/Support/Security/1801 and update all affected products to patched versions (GIGABYTE APP Center above v1.05.21, AORUS GRAPHICS ENGINE 1.57+, XTREME GAMING ENGINE 1.26+, OC GURU II above v2.08).
- Remove or block the vulnerable GDrv driver: If patched versions are unavailable or the software is no longer needed, uninstall GIGABYTE APP Center and related utilities. Block the known vulnerable driver hash using Windows Defender Application Control (WDAC) or a similar driver blocklist.
- Apply Microsoft's recommended driver blocklist: Microsoft maintains a driver blocklist that includes known vulnerable GIGABYTE drivers — ensure Windows Defender or your security tool enforces this blocklist.
- Monitor for BYOVD exploitation indicators: Review endpoint logs for unauthorized driver loads, unexpected kernel modules, and signs of security product tampering consistent with BYOVD attack patterns.
- Restrict driver installation privileges: Enforce policies that prevent non-administrative users from installing kernel drivers, reducing the attack surface for bring-your-own-vulnerable-driver techniques.
Technical Details
CVE-2018-19323 exploits the GDrv kernel-mode driver, which is installed as part of GIGABYTE's overclocking and system management utilities. The driver exposes IOCTL (Input/Output Control) interfaces that allow user-mode processes to issue read and write commands directly to CPU Machine Specific Registers (MSRs) without any access control checks or privilege validation. MSRs are processor-level registers that control fundamental CPU behaviors including power management, performance counters, and security features such as SMEP (Supervisor Mode Execution Prevention) and SMAP (Supervisor Mode Access Prevention). By writing to MSRs, an attacker can disable these kernel-protection mechanisms, enabling subsequent kernel code execution. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects the critical exploitability and full-impact nature of this driver exposure, and the technique fits the well-documented bring-your-own-vulnerable-driver (BYOVD) attack pattern favored by advanced threat actors.
Frequently Asked Questions
Is CVE-2018-19323 being actively exploited?
Yes. CISA has confirmed active exploitation by including CVE-2018-19323 in its Known Exploited Vulnerabilities catalog, with a remediation deadline of 2022-11-14. This vulnerability has been linked to ransomware campaigns and is associated with bring-your-own-vulnerable-driver (BYOVD) techniques used by threat actors to disable security software and gain kernel-level persistence.
What products are affected by CVE-2018-19323?
CVE-2018-19323 affects multiple GIGABYTE software products: GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before version 1.57, XTREME GAMING ENGINE before version 1.26, and OC GURU II v2.08. Any Windows system with these utilities installed and the GDrv driver loaded is potentially vulnerable.
How do I fix CVE-2018-19323?
Update all affected GIGABYTE products to patched versions per the GIGABYTE security advisory. If the software is unnecessary, remove it entirely and block the vulnerable GDrv driver using Windows Defender Application Control or the Microsoft driver blocklist. See the Remediation section for complete steps.
How severe is CVE-2018-19323?
CVE-2018-19323 is rated CRITICAL with a CVSS 3.1 score of 9.8. The vulnerability allows unrestricted kernel-level MSR access, enabling full system compromise. Its EPSS percentile of 94.3% and KEV catalog listing with ransomware association confirm that this is an actively exploited, high-priority vulnerability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.