Intel Ethernet Diagnostics Driver CVE-2015-2291

Upgrade Intel Ethernet diagnostics driver to version 1.3.1.0 or later by installing the patched Intel Network Adapter diagnostic software package available from Intel Security Center advisory INTEL-SA-00051 (https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00051&languageid=en-fr). Organizations should inventory systems for presence of IQVW32.sys and IQVW64.sys in the Windows drivers directory, checking file version properties to identify vulnerable 1.03.0.7 builds. If the diagnostics driver is not operationally required, completely remove Intel diagnostic utilities and manually delete the kernel drivers as a more secure alternative-this eliminates the attack surface entirely without functional impact on basic network adapter operation. For environments unable to immediately patch, implement compensating controls: restrict local administrator group membership using least-privilege principles, deploy application whitelisting to prevent unsigned kernel driver loading, enable Driver Signature Enforcement and enable Windows Defender Exploit Guard kernel protection features. Note that disabling the driver via Device Manager is insufficient-the IOCTL interfaces remain accessible until the driver files are removed or updated. Monitor for suspicious IOCTL activity via ETW kernel event tracing or EDR solutions flagging direct device object access to \Device\IQVW32 or \Device\IQVW64.