Lucene search

[email protected]NVD:CVE-2018-19321

HistoryDec 21, 2018 - 11:29 p.m.

CVE-2018-19321

2018-12-2123:29:00

[email protected]

web.nvd.nist.gov

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

51.3%

JSON

The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.

Affected configurations

Nvd

Node

gigabyteaorus_graphics_engineRange<1.57

gigabyteapp_centerRange<19.0422.1

gigabyteoc_guru_iiMatch2.08

gigabytextreme_gaming_engineRange<1.26

VendorProductVersionCPE
gigabyteaorus_graphics_engine*cpe:2.3:a:gigabyte:aorus_graphics_engine:*:*:*:*:*:*:*:*
gigabyteapp_center*cpe:2.3:a:gigabyte:app_center:*:*:*:*:*:*:*:*
gigabyteoc_guru_ii2.08cpe:2.3:a:gigabyte:oc_guru_ii:2.08:*:*:*:*:*:*:*
gigabytextreme_gaming_engine*cpe:2.3:a:gigabyte:xtreme_gaming_engine:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
gigabyte	aorus_graphics_engine	*	cpe:2.3:a:gigabyte:aorus_graphics_engine::::::::
gigabyte	app_center	*	cpe:2.3:a:gigabyte:app_center::::::::
gigabyte	oc_guru_ii	2.08	cpe:2.3:a:gigabyte:oc_guru_ii:2.08:::::::*
gigabyte	xtreme_gaming_engine	*	cpe:2.3:a:gigabyte:xtreme_gaming_engine::::::::