GIGABYTE Drivers Arbitrary Physical Memory Read/Write Local Privilege Escalation (CVE-2018-19321)

1. Vulnerability Overview & Root Cause

This vulnerability exists within the GPCIDrv and GDrv low-level kernel-mode drivers developed by GIGABYTE. These drivers are designed to facilitate hardware monitoring and overclocking from user-space utilities. However, they suffer from a critical design flaw where they expose input/output control (IOCTL) codes that allow arbitrary physical memory read and write operations without enforcing proper access controls or privilege checks. This allows any non-privileged local process to map and manipulate arbitrary physical memory addresses.

2. Exploitation Mechanics & Attack Scenario

An attacker must first obtain local execution capabilities on the target system. The attacker then opens a handle to the vulnerable driver's symbolic link (e.g., \\.\GDrv). By issuing specific IOCTL requests, the attacker can map physical memory into their user-space process. The attacker typically leverages this capability to locate the _EPROCESS structures of their own process and a system process (such as System PID 4) in memory, subsequently copying the security token of the system process to their own process (Token Stealing), thereby escalating privileges to NT AUTHORITY\SYSTEM. This driver is highly favored by threat actors in Bring Your Own Vulnerable Driver (BYOVD) campaigns to bypass modern OS-level security controls.

3. Infrastructure & Business Impact

As a CISA KEV-listed vulnerability, this flaw is actively exploited in the wild by advanced persistent threat (APT) groups and ransomware operators. Successful exploitation grants the attacker complete control over the compromised endpoint or server. With kernel-level privileges, attackers can disable endpoint detection and response (EDR) agents, terminate security software, install persistent kernel-mode rootkits, and facilitate lateral movement across the enterprise network, posing a severe threat to business operations and data integrity.