PT-2018-3846 · Gigabyte · Xtreme Gaming Engine+3

Diego Juarez · Published 2018-12-21 · Updated 2025-08-14 · CVE-2018-19321

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GIGABYTE APP Center versions 1.05.21 and earlier AORUS GRAPHICS ENGINE versions prior to 1.57 XTREME GAMING ENGINE versions prior to 1.26 OC GURU II version 2.08 and earlier

Description The issue is related to the GPCIDrv and GDrv low-level drivers, which expose functionality to read and write arbitrary physical memory due to an open IOCTL with insufficient access control. This could be leveraged by a local attacker to elevate privileges.

Recommendations For GIGABYTE APP Center versions 1.05.21 and earlier, update to a version later than 1.05.21. For AORUS GRAPHICS ENGINE versions prior to 1.57, update to version 1.57 or later. For XTREME GAMING ENGINE versions prior to 1.26, update to version 1.26 or later. For OC GURU II version 2.08 and earlier, update to a version later than 2.08.

Exploit

Fix

Weakness Enumeration

CWE-782

Related Identifiers

BDU:2022-06643

CVE-2018-19321

Affected Products

Aorus Graphics Engine

Gigabyte App Center

Oc Guru Ii

Xtreme Gaming Engine

References · 17

• 🔥 https://github.com/nanabingies/Driver-RW · Exploit
• 🔥 http://seclists.org/fulldisclosure/2018/Dec/39 · Exploit
• 🔥 https://secureauth.com/labs/advisories/gigabyte-drivers-elevation-privilege-vulnerabilities · Exploit
• https://osv.dev/vulnerability/CVE-2018-19321 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-19321 · Security Note
• https://bdu.fstec.ru/vul/2022-06643 · Security Note
• https://t.me/aptreports/21201 · Telegram Post
• https://gigabyte.com/Support/Utility/Motherboard · Note
• https://t.me/malwr/7267 · Telegram Post
• https://t.me/cvenotify/114825 · Telegram Post
• https://gigabyte.com/Support/Security/1801 · Vendor Advisory, Security Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-19321 · Note
• https://gigabyte.com/Support/Utility/Graphics-Card · Note
• https://t.me/aptreports/14500 · Telegram Post
• http://securityfocus.com/bid/106252 · Note