Privilege escalation in GIGABYTE Global products - CVE-2018-19322
Published: December 19, 2018 / Updated: October 24, 2022
Vulnerability identifier: #VU16622
CSH Severity: Medium
CVSS v4: 8.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-19322
CWE-ID: CWE-782
Exploitation vector: Local access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a local unauthenticated attacker to gain elevated privileges on the target device.
The weakness exists due to both GPCI and GIO expose functionality to read/write data from/to IO ports. A local attacker can execute arbitrary code with elevated privileges.
Affected software
AORUS GRAPHICS ENGINE
GIGABYTE APP Center
XTREME GAMING ENGINE
OC GURU
GIGABYTE APP Center
XTREME GAMING ENGINE
OC GURU
How to mitigate CVE-2018-19322
Cybersecurity Help is currently unaware of any official solution addressing the vulnerability.