CVE-2018-19321

What is GIGABYTE App Center / GPCIDrv-GDrv?

GIGABYTE's overclocking and system-tuning suite (App Center, AORUS Graphics Engine, XTREME Gaming Engine, OC GURU II) needs low-level hardware access to adjust fan curves, voltages, and clock speeds. To provide that access from a normal desktop application, GIGABYTE ships kernel-mode drivers — GPCIDrv and GDrv — that expose IOCTLs userland code can call to reach into hardware and physical memory.

Overview

GPCIDrv and GDrv expose functionality that lets a caller read and write arbitrary physical memory addresses. Because these are ring0 drivers with no meaningful access control on the IOCTL, any local process — regardless of its own privilege level — can use them to map and modify physical memory outside the normal boundaries the OS is supposed to enforce. That access is sufficient to escalate from a standard user account to full SYSTEM/kernel-level control.

Technical Details

The vulnerability is a privilege-escalation primitive rooted in unchecked kernel driver functionality (commonly classified under CWE-269, improper privilege management, or CWE-863, incorrect authorization). The driver's IOCTL handler accepts a physical address and length from the calling process and performs the requested read or write without verifying the caller's privilege level or the legitimacy of the target address. An attacker with only local, low-privileged access can use this to locate and overwrite kernel data structures — such as process token privileges — to escalate to SYSTEM, or to disable protective kernel state.

Discovery

GIGABYTE published security advisory 1801 addressing the vulnerable GPCIDrv/GDrv drivers bundled with its utility software, releasing updated builds that removed or restricted the dangerous IOCTLs. No specific third-party researcher credit is confidently documented for this entry.

Exploitation Context

CISA's KEV catalog flags this CVE for confirmed exploitation, and the ransomwareUse: true marker aligns with public reporting that ransomware operators (the RobbinHood campaign in 2019 being the most cited example) deliberately dropped the signed but vulnerable GIGABYTE driver onto victim machines. Because the driver carries a legitimate digital signature, it loads without triggering driver-signing protections, giving attackers a trusted foothold from which to read/write physical memory and blind security tooling before deploying ransomware payloads — a textbook Bring Your Own Vulnerable Driver (BYOVD) attack.

Remediation

1. Remove GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II from systems where the tuning functionality is not actually needed.
2. Where the software is required, update to the GIGABYTE release that replaces the vulnerable GPCIDrv/GDrv driver, per advisory 1801.
3. Enable Microsoft's vulnerable/blocked driver list (via HVCI, Smart App Control, or WDAC) so the known-bad driver hash cannot load even if present on disk.
4. Alert on unexpected loading of GIGABYTE kernel drivers on hosts that have no legitimate GIGABYTE hardware or software installed — a strong BYOVD indicator.
5. Audit endpoint security tooling for unexplained disablement events, which is the typical follow-on impact once attackers gain this kernel read/write primitive.