Loading vulnerability…
CVE-2018-19320 is an arbitrary kernel memory access vulnerability in the GIGABYTE GDrv low-level Windows driver distributed with APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08. The driver exposes ring-0 memcpy-like functionality that permits arbitrary memory reads and writes, allowing a local attacker to escalate privileges and take complete control of the affected system. RobbinHood ransomware has exploited the vulnerability to modify kernel memory, temporarily disable Windows driver signature enforcement, and load an unsigned malicious kernel driver.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains a local privilege escalation (LPE) exploit for CVE-2018-19320, targeting vulnerable GIGABYTE drivers (gdrv.sys) on Windows systems. The main exploit code is implemented in C++ (CVE-2018-19320-LPE-Exploit.cpp) and is designed to be built with Visual Studio. The exploit works by opening a handle to the vulnerable driver (\\.\GIO), allocating kernel memory, and writing custom shellcode that steals the SYSTEM process token. It then overwrites a function pointer in the HalDispatchTable to point to the shellcode, triggers execution via NtQueryIntervalProfile, and restores the original pointer to avoid system instability. Upon success, it launches a SYSTEM-level command prompt. The exploit specifically targets GIGABYTE software products with vulnerable driver versions, as listed in the README. The repository includes project files for building the exploit and a README with usage context and affected versions. No network endpoints are involved; the attack vector is purely local, requiring execution on a vulnerable system.
This repository is a Windows kernel exploit tool designed to load or unload unsigned drivers on Windows 10 and 11 systems. The main entry point is 'GDRVLoader.cpp', which provides a command-line interface for users to specify a target driver to load or unload. The tool works by dropping a vulnerable Gigabyte driver (gdrv.sys) to 'C:\Windows\System32\Drivers\gdrv.sys', loading it, and then exploiting its IOCTL interface (\Device\GIO) to manipulate kernel memory and disable Driver Signature Enforcement (DSE). This allows arbitrary unsigned drivers to be loaded, bypassing Windows security mechanisms such as PatchGuard and DSE. The exploit logic and kernel manipulation are primarily implemented in 'exploit/swind2.cpp', while 'exploit/pe.cpp' provides PE file mapping and export resolution utilities. The repository also includes a custom implementation of the Hacker Disassembler Engine (hde64) for binary analysis. The tool requires administrator privileges and is intended for advanced users or researchers needing to load unsigned drivers for testing or exploitation purposes. No network endpoints are present; all actions are performed locally on the target system.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vulnerability in Gigabyte's gdrv.sys driver used in BYOVD attacks. The article reports CVSS 7.8 and active exploitation, including ransomware use, but does not explain the underlying flaw.
A privilege escalation / arbitrary kernel memory read-write vulnerability in Gigabyte's signed GDRV.SYS driver that attackers abused to disable Windows driver signature enforcement and load an unsigned malicious driver during RobbinHood ransomware attacks.
A vulnerability in the gdrv.sys driver cited as a historical example of ransomware abusing vulnerable drivers to terminate endpoint protection processes. The article collectively references RobbinHood and AvosLocker alongside gdrv.sys and asWarPot.sys without explicitly mapping each ransomware family to an individual driver vulnerability.
A privilege-escalation vulnerability in Gigabyte's GDRV.SYS driver permits arbitrary memory reads and writes. RobbinHood abuses it to modify kernel memory, disable driver signature enforcement, and load a malicious driver that terminates endpoint-security processes and deletes their files before ransomware encryption. Although Gigabyte discontinued the vulnerable driver in 2018, its signing certificate remained valid.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.