GIGABYTE 드라이버(GPCIDrv/GDrv) 권한 상승 및 커널 코드 실행 취약점 (CVE-2018-19322)

# 취약한 GIGABYTE 서비스 중지 및 비활성화
Stop-Service -Name 'GDrv' -ErrorAction SilentlyContinue
Set-Service -Name 'GDrv' -StartupType Disabled -ErrorAction SilentlyContinue

# 설치된 구버전 애플리케이션 제거 (App Center 등)
Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like '*GIGABYTE*' } | ForEach-Object { 
    Write-Host 'Uninstalling: ' $_.Name
    $_.Uninstall() 
}

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CI\Config]
"VulnerableDriverBlocklistEnable"=dword:00000001

# 시스템 내 gdrv.sys 파일 탐색
$DriverPath = Get-ChildItem -Path 'C:\Windows\System32\drivers' -Filter 'gdrv.sys' -Recurse -ErrorAction SilentlyContinue
if ($DriverPath) {
    Write-Host '[WARNING] Vulnerable GIGABYTE driver file detected:' $DriverPath.FullName -ForegroundColor Red
} else {
    Write-Host '[OK] No vulnerable gdrv.sys file found in drivers directory.' -ForegroundColor Green
}

# 현재 메모리에 로드된 드라이버 확인
$LoadedDriver = Get-WmiObject Win32_SystemDriver | Where-Object { $_.Name -eq 'GDrv' -or $_.PathName -like '*gdrv.sys*' }
if ($LoadedDriver) {
    Write-Host '[ALERT] Vulnerable GIGABYTE driver is currently LOADED in memory!' -ForegroundColor Red
} else {
    Write-Host '[OK] Vulnerable driver is not loaded.' -ForegroundColor Green
}