CVE-2018-19320

What is GIGABYTE App Center / GDrv?

GIGABYTE bundles a kernel-mode driver called GDrv (GDrv.sys) with several of its consumer utilities — App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II. These tools let end users read hardware sensors and tune overclocking settings for GIGABYTE motherboards and graphics cards from a Windows desktop application. To do that safely (fan curves, voltage tweaks, memory timings), the tuning software needs a way to talk directly to hardware from ring0, so GIGABYTE ships a signed kernel driver that userland code can call into via DeviceIoControl.

Overview

GDrv.sys exposes an IOCTL that behaves like a raw memcpy primitive: it takes attacker-controlled source/destination addresses and a length, and copies data between them with no validation of who is calling or what memory is being touched. Because the driver is signed by GIGABYTE and loads without any additional prompt, any process running with local user privileges can open a handle to the device and use this IOCTL to read or write arbitrary kernel memory — a complete escape from the normal privilege boundary between user mode and ring0.

This is one of four related CVEs (19320–19323) affecting the same family of GIGABYTE drivers; each covers a distinct dangerous IOCTL exposed by GDrv/GPCIDrv.

Technical Details

The flaw is a classic "vulnerable driver" issue: legitimate, digitally signed software includes a kernel component with an IOCTL handler that fails to restrict what a calling process can do with it. Because Windows trusts signed drivers to load, and GDrv.sys was signed by a legitimate vendor, security products and Driver Signature Enforcement did not block it. A local, low-privileged process could issue the IOCTL with attacker-chosen physical or virtual addresses and copy arbitrary data into or out of kernel space, enabling full read/write access to kernel memory — sufficient to disable security mitigations, patch kernel structures, or escalate to SYSTEM.

Discovery

The driver flaws were identified and reported to GIGABYTE, which published security advisory 1801 acknowledging the GDrv/GPCIDrv issues and released updated driver versions. No CVE-specific third-party researcher credit is confidently documented for this individual entry.

Exploitation Context

This CVE's presence in the CISA KEV catalog with ransomwareUse: true reflects the well-documented "Bring Your Own Vulnerable Driver" (BYOVD) technique: ransomware operators (notably the RobbinHood ransomware crew in 2019) dropped a legitimately signed but vulnerable GIGABYTE driver onto target machines specifically to exploit this class of flaw, using the kernel read/write primitive to disable or blind endpoint security software before deploying their payload. Because the driver is signed, it bypasses signature-enforcement checks that would normally block an attacker's own kernel code.

Remediation

1. Uninstall GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II if they are not actively required — these utilities are the only reason the vulnerable driver is present.
2. If the tools are required, update to the GIGABYTE-supplied versions that replace the vulnerable GDrv/GPCIDrv driver per advisory 1801.
3. Use Microsoft's vulnerable driver blocklist (HVCI/Smart App Control driver blocklist, or manually via Set-VMSecurityBlockList/WDAC policies) to block loading of the known-vulnerable GDrv.sys hash even if the utility remains installed.
4. Monitor endpoint detection tooling for alerts on third-party signed drivers being loaded outside of normal software installation/update activity — a common indicator of BYOVD abuse.
5. Treat any unexpected presence of GIGABYTE driver files on systems that don't have GIGABYTE hardware as a strong indicator of malicious BYOVD staging.