CVE-2018-19323

What is GIGABYTE App Center / GPCIDrv-GDrv?

GIGABYTE bundles kernel-mode drivers — GPCIDrv and GDrv — with its App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU utilities so that the desktop application can adjust hardware settings like clock speeds, voltages, and fan curves directly from ring0.

Overview

Note that NVD's CVSS vector for this entry (AV:N/PR:N) differs from its three sibling CVEs (19320–19322), which are scored as local, privilege-required issues — NVD's scoring here treats the exposed physical-memory read/write as reachable without authentication or local privilege prerequisites, pushing the score to CRITICAL/9.8. Functionally, the underlying flaw is the same family issue: GPCIDrv and GDrv expose functionality to read and write arbitrary physical memory addresses, letting a caller manipulate memory well outside what a hardware-tuning utility should ever need to touch.

Technical Details

The driver's IOCTL interface accepts a physical address and performs a raw read or write with no meaningful validation of the caller's identity, privilege level, or the legitimacy of the target address. Arbitrary physical memory read/write is one of the most powerful primitives an attacker can obtain short of direct code execution — it can be used to locate and modify kernel objects (such as process tokens) to escalate privileges, or to patch out security mitigations entirely.

Discovery

GIGABYTE published security advisory 1801 covering the vulnerable GPCIDrv/GDrv driver family and released corrected driver builds. No specific third-party researcher credit is confidently documented for this individual CVE.

Exploitation Context

Along with its three sibling CVEs, this vulnerability is documented in CISA's KEV catalog with confirmed exploitation and a ransomwareUse: true flag. Public reporting on the RobbinHood ransomware campaign (2019) describes attackers deploying this exact class of signed-but-vulnerable GIGABYTE driver as part of a Bring Your Own Vulnerable Driver (BYOVD) technique — loading the trusted driver to gain kernel memory access, then using it to disable or kill endpoint security software immediately before encrypting files.

Remediation

1. Remove GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU where the tuning functionality is not in active use.
2. Where required, update to the GIGABYTE version addressing advisory 1801, which replaces the vulnerable driver.
3. Deploy Microsoft's vulnerable driver blocklist (HVCI, Smart App Control, or WDAC policy) to block the known-bad driver hash even if the software remains installed.
4. Treat unexpected GIGABYTE kernel driver activity on systems without corresponding GIGABYTE hardware as a strong indicator of BYOVD staging and investigate immediately.
5. Review endpoint protection logs for unexplained disablement or crashes, the typical follow-on behavior once this primitive is exploited.