CVE-2015-2291
HIGHCVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5Tags
Description
(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cause a denial of service or possibly execute arbitrary code with kernel privileges via a crafted (a) 0x80862013, (b) 0x8086200B, (c) 0x8086200F, or (d) 0x80862007 IOCTL call.
Analysis
Intel Ethernet diagnostics driver IQVW32.sys/IQVW64.sys allows local users to execute arbitrary code with kernel privileges via crafted IOCTL calls, widely abused as a 'Bring Your Own Vulnerable Driver' (BYOVD) attack vector.
Technical Context
The CWE-20 input validation flaw in the Intel driver allows several IOCTL codes (0x80862013, 0x8086200B, 0x8086200F, 0x80862007) to be abused for arbitrary physical memory read/write operations from user mode. Since the driver is legitimately signed by Intel, it can be loaded on systems with driver signing enforcement.
Affected Products
['Intel Ethernet diagnostics driver IQVW32.sys before 1.3.1.0', 'Intel Ethernet diagnostics driver IQVW64.sys before 1.3.1.0']
Remediation
Block the vulnerable driver via Windows Defender Application Control (WDAC) vulnerable driver blocklist. Monitor for loading of known vulnerable drivers. Update Intel network drivers to versions without the diagnostics component.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today