Actively exploited · Published Aug 9, 2017 · Assigned by mitre
CVE-2015-2291
High 7.8 Exploited Ransomware
In plain English
A high-severity improper input validation in Ethernet Diagnostics Driver for Windows from Intel. Attackers are actively exploiting it in the wild (listed by CISA on February 10, 2023). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 15.7% (higher than 97% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Mar 3, 2023.
Official description
(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cause a denial of service or possibly execute arbitrary code with kernel privileges via a crafted (a) 0x80862013, (b) 0x8086200B, (c) 0x8086200F, or (d) 0x80862007 IOCTL call.
Affected products (as reported)
Weakness: CWE-20 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- 36392 exploit, x_refsource_EXPLOIT-DB
- https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00051&languageid=en-fr x_refsource_CONFIRM
- http://packetstormsecurity.com/files/130854/Intel-Network-Adapter-Diagnostic-Driver-IOCTL-DoS.html x_refsource_MISC
- 79623 vdb-entry, x_refsource_BID
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-2291 government-resource