Privilege escalation in GIGABYTE Global products - CVE-2018-19321
Published: December 19, 2018 / Updated: October 24, 2022
Vulnerability identifier: #VU16624
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-19321
CWE-ID: CWE-782
Exploitation vector: Local access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a local unauthenticated attacker to gain elevated privileges on the target device.
The weakness exists due to both GPCI and GIO expose functionality to read/write arbitrary physical memory. A local attacker can gain elevated privileges.
Affected software
AORUS GRAPHICS ENGINE
GIGABYTE APP Center
XTREME GAMING ENGINE
OC GURU
GIGABYTE APP Center
XTREME GAMING ENGINE
OC GURU
How to mitigate CVE-2018-19321
Cybersecurity Help is currently unaware of any official solution addressing the vulnerability.