Veille CVE
CVE-2018-19323
9.8 Critique Exploitée activement Utilisée par des rançongicielsCatalogue CISA KEV — GIGABYTE Multiple Products Privilege Escalation Vulnerability
Ajoutée le 24/10/2022 · Échéance de correction (agences US) : 14/11/2022
Action requise : Apply updates per vendor instructions.
Description
The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes functionality to read and write Machine Specific Registers (MSRs).
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 9.8 Critique | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | 9.8 Critique | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 2.0 | 9.0 Élevée | nvd@nist.gov (NVD) | AV:N/AC:L/Au:N/C:P/I:P/A:C |
Références
- http://seclists.org/fulldisclosure/2018/Dec/39 ExploitMailing ListThird Party Advisory
- http://www.securityfocus.com/bid/106252 Broken LinkThird Party AdvisoryVDB Entry
- https://www.gigabyte.com/Support/Security/1801 Vendor Advisory
- https://www.gigabyte.com/tw/Support/Utility/Graphics-Card Product
- https://www.secureauth.com/labs/advisories/gigabyte-drivers-elevation-privilege-vulnerabilities Broken LinkExploitThird Party Advisory
- http://seclists.org/fulldisclosure/2018/Dec/39 ExploitMailing ListThird Party Advisory
- http://www.securityfocus.com/bid/106252 Broken LinkThird Party AdvisoryVDB Entry
- https://www.gigabyte.com/Support/Security/1801 Vendor Advisory
- https://www.gigabyte.com/tw/Support/Utility/Graphics-Card Product
- https://www.secureauth.com/labs/advisories/gigabyte-drivers-elevation-privilege-vulnerabilities Broken LinkExploitThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-19323 US Government Resource