9.8Kritik
KEV
Fidye yazılımında kullanılıyor
CVE-2018-19323GIGABYTE Multiple Products Privilege Escalation Vulnerability
Aktif olarak istismar ediliyor — GIGABYTE Multiple Products Privilege Escalation Vulnerability
CISA bu açığın gerçek saldırılarda kullanıldığını 24.10.2022 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 14.11.2022.
Gerekli işlem: Apply updates per vendor instructions. https://www.gigabyte.com/Support/Security/1801; https://nvd.nist.gov/vuln/detail/CVE-2018-19323
Açıklama
The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes functionality to read and write Machine Specific Registers (MSRs).
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| gigabyte | aorus graphics engine | < 1.57 | |
| gigabyte | gigabyte app center | ≤ 1.05.21 | |
| gigabyte | oc guru ii | 2.08 | |
| gigabyte | xtreme gaming engine | < 1.26 |
Kaynaklar ve yamalar
- 20181221 [CORE-2018-0007] - GIGABYTE Driver Elevation of Privilege Vulnerabilities mailing-listExploitMailing ListThird Party Advisory
- https://www.secureauth.com/labs/advisories/gigabyte-drivers-elevation-privilege-vulnerabilities Broken LinkExploitThird Party Advisory
- 106252 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- https://www.gigabyte.com/tw/Support/Utility/Graphics-Card Product
- https://www.gigabyte.com/Support/Security/1801 Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-19323 US Government Resource
CPE eşleşmeleri (NVD) (4)
cpe:2.3:a:gigabyte:aorus_graphics_engine:*:*:*:*:*:*:*:*< 1.57cpe:2.3:a:gigabyte:gigabyte_app_center:*:*:*:*:*:*:*:*≤ 1.05.21cpe:2.3:a:gigabyte:oc_guru_ii:2.08:*:*:*:*:*:*:*cpe:2.3:a:gigabyte:xtreme_gaming_engine:*:*:*:*:*:*:*:*< 1.26