CVE-2018-19322

What is GIGABYTE App Center / GPCIDrv-GDrv?

GIGABYTE's system-tuning suite (App Center, AORUS Graphics Engine, XTREME Gaming Engine, OC GURU II) ships with kernel drivers — GPCIDrv and GDrv — that give the userland application direct access to hardware so it can adjust fan speeds, clocks, and voltages on GIGABYTE motherboards and graphics cards.

Overview

CWE-749 ("Exposed Dangerous Method or Function") is the operative weakness here: GPCIDrv and GDrv expose IOCTLs that let a calling process read from and write to arbitrary CPU I/O ports. I/O ports control low-level hardware functions directly, and unrestricted access to them can be leveraged in a number of ways to ultimately achieve arbitrary code execution at the highest privilege level — for example by manipulating hardware state to corrupt kernel memory or bypass protections that would otherwise stop a user-mode process from running code in ring0.

Technical Details

Because the vulnerable IOCTL is exposed by a signed, trusted kernel driver, Windows Driver Signature Enforcement and most kernel-mode protections do not block it. A local process with only ordinary user privileges can open a handle to the device and issue port I/O requests with attacker-chosen port addresses and data. Depending on the hardware and chipset in use, this can be chained into full code execution in kernel context — the same class of "exposed dangerous method" issue that has affected many overclocking and hardware-monitoring utilities across vendors, not just GIGABYTE.

Discovery

GIGABYTE addressed the flaw via security advisory 1801, updating the GPCIDrv/GDrv drivers distributed with its utility software. No specific third-party researcher credit is confidently documented for this individual CVE.

Exploitation Context

This CVE's KEV listing and ransomwareUse: true flag are consistent with public reporting on the RobbinHood ransomware campaign (2019), which abused this family of signed GIGABYTE drivers as a Bring Your Own Vulnerable Driver (BYOVD) technique to gain kernel-level access and disable endpoint security products before deploying ransomware. The signed nature of the driver is what makes it attractive to attackers — it loads without raising the same alarms an unsigned malicious driver would.

Remediation

1. Remove GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II where the overclocking functionality isn't actually needed.
2. Where required, update to the GIGABYTE release addressing advisory 1801, which replaces the vulnerable GPCIDrv/GDrv drivers.
3. Block the known-vulnerable driver by hash using Microsoft's vulnerable driver blocklist (HVCI/Smart App Control/WDAC).
4. Monitor for unexpected loading of GIGABYTE kernel drivers on machines without corresponding GIGABYTE hardware or software, a common BYOVD red flag.
5. Investigate any unexplained termination or tampering of security agents, which is the typical objective once an attacker gains this level of kernel access.