CVE-2015-2291 Intel Ethernet Diagnostics Driver for Windows Denial-of-Service
Local attackers can execute arbitrary code with kernel privileges via crafted IOCTL calls in the Intel Ethernet diagnostics driver.
- Exploited in the wild
- Since 10 Feb 2023
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2015-2291?
CVE-2015-2291 is a high-severity vulnerability in n/a, published on 9 Aug 2017. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cause a denial of service or possibly execute arbitrary code with kernel privileges via a crafted (a) 0x80862013, (b) 0x8086200B, (c) 0x8086200F, or (d) 0x80862007 IOCTL call.
Weakness: CWE-20
Which versions are affected by CVE-2015-2291?
It affects 2 products.
Products include Intel Ethernet Diagnostics Driver Iqvw32.sys, Intel Ethernet Diagnostics Driver Iqvw64.sys.
How do I fix CVE-2015-2291?
No fix has been published for CVE-2015-2291 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 3 Mar 2023.
Is CVE-2015-2291 being exploited?
Yes. Attackers have exploited CVE-2015-2291 in the wild since at least 10 Feb 2023, including in ransomware campaigns.
Public exploit code: 1 Exploit-DB entry and 4 proofs of concept on GitHub.
Sources
Also known as GHSA-4w4w-866c-5vgg.