Veille CVE
CVE-2018-19321
7.8 Élevée Exploitée activement Utilisée par des rançongicielsCatalogue CISA KEV — GIGABYTE Multiple Products Privilege Escalation Vulnerability
Ajoutée le 24/10/2022 · Échéance de correction (agences US) : 14/11/2022
Action requise : Apply updates per vendor instructions.
Description
The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 7.8 Élevée | nvd@nist.gov (NVD) | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | 7.8 Élevée | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 2.0 | 7.2 Élevée | nvd@nist.gov (NVD) | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Références
- http://seclists.org/fulldisclosure/2018/Dec/39 ExploitMailing ListThird Party Advisory
- http://www.securityfocus.com/bid/106252 Broken LinkThird Party AdvisoryVDB Entry
- https://www.gigabyte.com/Support/Security/1801 Vendor Advisory
- https://www.secureauth.com/labs/advisories/gigabyte-drivers-elevation-privilege-vulnerabilities Broken LinkExploitThird Party Advisory
- http://seclists.org/fulldisclosure/2018/Dec/39 ExploitMailing ListThird Party Advisory
- http://www.securityfocus.com/bid/106252 Broken LinkThird Party AdvisoryVDB Entry
- https://www.gigabyte.com/Support/Security/1801 Vendor Advisory
- https://www.secureauth.com/labs/advisories/gigabyte-drivers-elevation-privilege-vulnerabilities Broken LinkExploitThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-19321 US Government Resource