High · published December 22, 2018
CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 89.7th percentile for exploit probability.
🚨 Local attackers have a golden ticket here! With a simple exploit, they can read and write arbitrary physical memory in GIGABYTE's APP Center and its companions, which has been the case since version 1.05.21. 🔥 Think of this vulnerability like a sneaky insider at a restaurant who can access the kitchen — they can not only check the menu (read memory) but also change the recipes (write memory) without anyone noticing! This could lead to absolutely devastating consequences, where an attacker gains elevated privileges, potentially allowing them to manipulate or steal confidential data at will. Imagine a thief not only entering your home but also changing your locks and stealing your valuables; that's the level of access they're getting!
Think of this vulnerability like a sneaky insider at a restaurant who can access the kitchen — they can not only check the menu (read memory) but also change the recipes (write memory) without anyone noticing! The GPCIDrv and GDrv drivers expose functionality that allows local users to read and write to physical memory, bypassing normal security mechanisms and enabling privilege escalation.
This could lead to absolutely devastating consequences, where an attacker gains elevated privileges, potentially allowing them to manipulate or steal confidential data at will. Imagine a thief not only entering your home but also changing your locks and stealing your valuables; that's the level of access they're getting! To protect your systems, update the GIGABYTE APP Center to version 1.05.22 or later, and ensure you're using the latest versions of AORUS GRAPHICS ENGINE (1.57), XTREME GAMING ENGINE (1.26), and OC GURU II (2.08). It's crucial to audit the use of these drivers within your environment. You've got this! With these updates, you can ensure your system is safe and secure. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| gigabyte/aorus_graphics_engine | < 1.57 | 1.57 |
| gigabyte/app_center | < 19.0422.1 | 19.0422.1 |
| gigabyte/oc_guru_ii | all versions | — |
| gigabyte/xtreme_gaming_engine | < 1.26 | 1.26 |