Loading vulnerability…
CVE-2018-19320 is a local privilege escalation vulnerability in the GDrv low-level driver distributed with GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08. The signed kernel driver exposes memcpy-like ring 0 functionality that permits arbitrary kernel memory access, including read and write operations. Because the driver runs with kernel privileges and inadequately restricts access to sensitive memory operations, a local attacker can use it as a primitive to modify critical kernel state. Public reporting also documents abuse of this flaw to alter Windows code integrity settings in memory and disable driver signature enforcement, enabling the loading of unsigned kernel code.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains a local privilege escalation (LPE) exploit for CVE-2018-19320, targeting vulnerable GIGABYTE drivers (gdrv.sys) on Windows systems. The main exploit code is implemented in C++ (CVE-2018-19320-LPE-Exploit.cpp) and is designed to be built with Visual Studio. The exploit works by opening a handle to the vulnerable driver (\\.\GIO), allocating kernel memory, and writing custom shellcode that steals the SYSTEM process token. It then overwrites a function pointer in the HalDispatchTable to point to the shellcode, triggers execution via NtQueryIntervalProfile, and restores the original pointer to avoid system instability. Upon success, it launches a SYSTEM-level command prompt. The exploit specifically targets GIGABYTE software products with vulnerable driver versions, as listed in the README. The repository includes project files for building the exploit and a README with usage context and affected versions. No network endpoints are involved; the attack vector is purely local, requiring execution on a vulnerable system.
This repository is a Windows kernel exploit tool designed to load or unload unsigned drivers on Windows 10 and 11 systems. The main entry point is 'GDRVLoader.cpp', which provides a command-line interface for users to specify a target driver to load or unload. The tool works by dropping a vulnerable Gigabyte driver (gdrv.sys) to 'C:\Windows\System32\Drivers\gdrv.sys', loading it, and then exploiting its IOCTL interface (\Device\GIO) to manipulate kernel memory and disable Driver Signature Enforcement (DSE). This allows arbitrary unsigned drivers to be loaded, bypassing Windows security mechanisms such as PatchGuard and DSE. The exploit logic and kernel manipulation are primarily implemented in 'exploit/swind2.cpp', while 'exploit/pe.cpp' provides PE file mapping and export resolution utilities. The repository also includes a custom implementation of the Hacker Disassembler Engine (hde64) for binary analysis. The tool requires administrator privileges and is intended for advanced users or researchers needing to load unsigned drivers for testing or exploitation purposes. No network endpoints are present; all actions are performed locally on the target system.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A privilege escalation / arbitrary kernel memory read-write vulnerability in Gigabyte's signed GDRV.SYS driver that attackers abused to disable Windows driver signature enforcement and load an unsigned malicious driver during RobbinHood ransomware attacks.
A vulnerability in the GIGABYTE GDRV.SYS kernel driver that allows privileged kernel memory operations (used here to disable DSE by modifying code integrity variables), enabling loading of malicious drivers.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.