PT-2018-3844 · Gigabyte · Xtreme Gaming Engine+3

Published 2018-12-21 · Updated 2025-03-14 · CVE-2018-19323

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GIGABYTE APP Center versions 1.05.21 and earlier AORUS GRAPHICS ENGINE versions before 1.57 XTREME GAMING ENGINE versions before 1.26 OC GURU II version 2.08

Description The issue is related to the GDrv low-level driver, which exposes functionality to read and write Machine Specific Registers (MSRs). This is due to insufficient access control, allowing an attacker to potentially execute arbitrary code.

Recommendations For GIGABYTE APP Center versions 1.05.21 and earlier, update to a version later than 1.05.21. For AORUS GRAPHICS ENGINE versions before 1.57, update to version 1.57 or later. For XTREME GAMING ENGINE versions before 1.26, update to version 1.26 or later. For OC GURU II version 2.08, update to a version later than 2.08.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2022-06641

CVE-2018-19323

Affected Products

Aorus Graphics Engine

Gigabyte App Center

Oc Guru Ii

Xtreme Gaming Engine

References · 14

• 🔥 http://seclists.org/fulldisclosure/2018/Dec/39 · Exploit
• 🔥 https://secureauth.com/labs/advisories/gigabyte-drivers-elevation-privilege-vulnerabilities · Exploit
• https://osv.dev/vulnerability/CVE-2018-19323 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-19323 · Security Note
• https://bdu.fstec.ru/vul/2022-06641 · Security Note
• https://gigabyte.com/Support/Utility/Motherboard · Note
• https://t.me/cvenotify/114827 · Telegram Post
• https://gigabyte.com/Support/Security/1801 · Vendor Advisory, Security Note
• https://gigabyte.com/Support/Utility/Graphics-Card · Note
• https://t.me/aptreports/14500 · Telegram Post
• http://securityfocus.com/bid/106252 · Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-19323 · Note
• https://gigabyte.com/tw/Support/Utility/Graphics-Card · Note
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note