Gigabyte kernel driver bug LPE

The Gigabyte kernel driver gdrv3.sys, signed and shipped with Gigabyte App Center and EasyTune, exposes a device \.\GIOV3 without security descriptors, allowing any local user to open it without admin rights or UAC prompts. The driver implements two problematic IOCTLs. The first IOCTL (0xC3502019) reads physical memory but fails to validate the user-supplied output pointer, enabling an arbitrary write-what-where primitive. This allows reading the SYSTEM process token from physical memory and overwriting the current process token to escalate privileges. The second IOCTL pair (0xC3502584 read, 0xC3502580 write) allows arbitrary MSR access without index whitelisting, enabling KASLR bypass and syscall entry hijacking. The exploit requires no kernel code execution or memory corruption, bypassing SMEP, SMAP, and other kernel protections. The vulnerability was tested on Windows 10 x64 22H2 (build 19045). Gigabyte fixed the issue by adding an SDDL security descriptor restricting device access to admins and whitelisting MSR writes, rendering the current driver non-exploitable via these vectors.

An unprivileged local user can escalate privileges to SYSTEM by exploiting the driver’s lack of access control and improper validation of IOCTL parameters. This allows arbitrary kernel memory writes, token stealing, and bypassing kernel security features such as SMEP and SMAP. The vulnerability compromises system integrity and security on affected Gigabyte systems with the vulnerable driver loaded.

Gigabyte has released a fixed version of the gdrv3.sys driver that adds a security descriptor restricting device access to administrators and implements a whitelist for MSR writes. Users should update Gigabyte App Center and EasyTune to the latest versions containing the patched driver. No additional mitigations are required once the updated driver is installed.