GIGABYTE GDrv Driver MSR Arbitrary Read/Write Privilege Escalation Vulnerability (CVE-2018-19323)

1. Vulnerability Overview & Root Cause

This vulnerability exists in the gdrv.sys low-level kernel driver utilized by various GIGABYTE hardware management utilities. The root cause lies in an insecure design where the driver exposes Input/Output Control (IOCTL) codes that allow user-mode applications to read and write Machine Specific Registers (MSRs) without proper privilege validation. This architectural flaw permits non-privileged local processes to manipulate critical CPU control registers directly.

2. Exploitation Mechanics & Attack Scenario

An attacker with local execution capabilities opens a handle to the symbolic link exposed by the vulnerable gdrv.sys driver. By dispatching specific IOCTL requests via the DeviceIoControl API, the attacker can read or write to arbitrary MSRs. In a typical exploitation scenario, the attacker targets the IA32_LSTAR MSR, which registers the system call entry point. By overwriting this register with the address of user-controlled shellcode, any subsequent system call triggers execution in Ring 0 (kernel mode), allowing the attacker to disable Driver Signature Enforcement (DSE) and load unsigned malicious drivers.

3. Infrastructure & Business Impact

As a CISA KEV-listed vulnerability, this flaw is actively exploited in the wild by threat actors employing 'Bring Your Own Vulnerable Driver' (BYOVD) techniques. Successful exploitation allows attackers to bypass kernel-level security monitoring (EDR/AV agents), establish persistent administrative access, and execute high-impact payloads such as ransomware, posing a severe threat to enterprise infrastructure and business continuity.