CVE-2018-19322

The GPCIDrv and GDrv low-level kernel drivers bundled with GIGABYTE APP Center (v1.05.21 and earlier), AORUS GRAPHICS ENGINE (before 1.57), XTREME GAMING ENGINE (before 1.26) and OC GURU II (v2.08) expose functionality that lets user-mode code read and write system IO ports. Any local, unprivileged process on a Windows host where the driver is loaded can invoke this exposed interface, and the arbitrary IO port read/write primitive can be leveraged in several ways to ultimately run code with elevated privileges — a local privilege escalation (CVSS 3.1 score 7.8, local attack vector, high impact). Affected users are owners of GIGABYTE motherboards or graphics cards who installed any of the four listed utilities, with the important caveat that the low-level drivers can remain installed and loaded even after the utility itself is uninstalled. Exploitation is confirmed: CISA added the flaw to its KEV catalog on 2022-10-24 with known ransomware use, and reporting at the time noted hackers actively exploiting it (alongside the Cisco AnyConnect flaw) in ransomware campaigns.

What to do: Apply updates per vendor instructions: upgrade APP Center beyond v1.05.21, AORUS GRAPHICS ENGINE to 1.57 or later, XTREME GAMING ENGINE to 1.26 or later, and OC GURU II to a release beyond v2.08. Because the drivers can remain loaded even after the utilities are uninstalled, check Windows systems for GPCIDrv.sys/GDrv.sys still present in the drivers directory or driver list and remove or replace vulnerable instances. Since the flaw is a local privilege escalation actively used with ransomware, prioritize hosts where an attacker may have chained it to gain elevated privileges.