CVE-2015-2291
Intel Ethernet Diagnostics Driver for Windows Denial-of-Service Vulnerability
Description
CVE-2015-2291 is an improper input validation vulnerability in the Intel Ethernet Diagnostics Driver for Windows, specifically affecting the IQVW32.sys and IQVW64.sys kernel-mode drivers prior to version 1.3.1.0. By sending crafted IOCTL calls to the vulnerable driver, a local attacker can cause a denial of service or execute arbitrary code with kernel-level privileges. This Intel Ethernet diagnostics driver vulnerability has been widely abused in Bring Your Own Vulnerable Driver (BYOVD) attacks and is associated with known ransomware campaigns. CISA has added CVE-2015-2291 to its Known Exploited Vulnerabilities catalog, and with an EPSS score of 4.3% (88th percentile), it remains a significant threat despite being over a decade old.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| intel | ethernet diagnostics driver iqvw32.sys | 1.03.0.7 |
| intel | ethernet diagnostics driver iqvw64.sys | 1.03.0.7 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/130854/Intel-Network-Adapter-Diagnostic-Driver-IOCTL-DoS.html(Third Party Advisory, VDB Entry)
- http://www.securityfocus.com/bid/79623(Broken Link, Third Party Advisory, VDB Entry)
- https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00051&languageid=en-fr(Patch, Vendor Advisory)
- https://www.exploit-db.com/exploits/36392/(Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-2291(US Government Resource)
Weakness Type
CWE-20: Improper Input Validation
Improper input validation occurs when software does not properly check input data before processing it, allowing attackers to supply unexpected values that alter program behavior. In CVE-2015-2291, the Intel Ethernet Diagnostics Driver fails to validate IOCTL call parameters, allowing a local attacker to send crafted IOCTL requests (0x80862013, 0x8086200B, 0x8086200F, 0x80862007) that trigger denial of service or arbitrary kernel code execution.
Learn more: CWE-20 — Improper Input Validation
Impact Analysis
Attack Vector (Local): CVE-2015-2291 requires local access to the target system where the vulnerable Intel Ethernet Diagnostics Driver is installed or can be loaded. Attack Complexity (Low): Exploitation is straightforward — the attacker simply sends crafted IOCTL calls to the driver, requiring no special conditions. Privileges Required (Low): Only standard user privileges are needed to interact with the vulnerable driver, and no user interaction is required. Confidentiality, Integrity, and Availability (all High): Successful exploitation can grant kernel-level code execution, giving the attacker complete control over the operating system, including access to all data, the ability to modify any system component, and the power to crash or disable the system. The CVSS score of 7.8 (High severity) reflects these serious impacts. This vulnerability is particularly dangerous because it is commonly used in BYOVD (Bring Your Own Vulnerable Driver) attacks, where threat actors deliberately install the vulnerable driver on target systems even if it was not previously present, then exploit it to gain kernel access. Its confirmed association with ransomware campaigns makes it a high-priority threat.
Exploit Maturity
Active exploitation of CVE-2015-2291 has been confirmed by CISA, which added this vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of March 3, 2023. This Intel Ethernet Diagnostics Driver vulnerability has been associated with known ransomware campaigns and is a favored tool in BYOVD (Bring Your Own Vulnerable Driver) attack chains. Public exploit code is available for CVE-2015-2291 via Exploit-DB and Packet Storm Security, making it accessible to a broad range of threat actors. The EPSS score of 4.3% (88th percentile) reflects ongoing exploitation probability. Despite being disclosed in 2015, this vulnerability remains actively weaponized due to the BYOVD attack technique, which allows attackers to deploy the vulnerable driver on systems regardless of whether Intel hardware is present.
Remediation
- Update the Intel Ethernet Diagnostics Driver to version 1.3.1.0 or later. As directed by CISA: "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable." If the driver is not needed, remove it entirely from the system. Refer to the Intel Security Advisory INTEL-SA-00051 for patch details.
- Implement driver blocklisting to prevent BYOVD attacks. Use the Microsoft Recommended Driver Block Rules (part of Windows Defender Application Control / WDAC) to block loading of vulnerable IQVW32.sys and IQVW64.sys versions. This is critical because attackers commonly deploy the vulnerable driver themselves as part of the exploitation chain.
- Enable Hypervisor-Protected Code Integrity (HVCI). HVCI prevents unsigned or known-vulnerable kernel drivers from loading, providing strong protection against BYOVD attacks. Ensure HVCI is enabled on all Windows 10 and later systems that support it.
- Monitor for vulnerable driver loading events. Configure endpoint detection and response (EDR) tools and Windows Event Logs to alert on loading of IQVW32.sys or IQVW64.sys drivers. Any attempt to load these drivers on systems without Intel Ethernet hardware is highly suspicious and may indicate an active BYOVD attack.
- Audit and restrict kernel driver loading privileges. Limit which accounts and processes can load kernel-mode drivers. Implement strict code signing requirements and use application control policies to prevent unauthorized driver installations.
Technical Details
Vulnerability Mechanism: CVE-2015-2291 resides in the Intel Ethernet Diagnostics Driver (IQVW32.sys for 32-bit and IQVW64.sys for 64-bit Windows) prior to version 1.3.1.0. The driver exposes IOCTL (Input/Output Control) interfaces that fail to properly validate user-supplied parameters — a classic case of improper input validation (CWE-20). Specifically, IOCTL codes 0x80862013, 0x8086200B, 0x8086200F, and 0x80862007 accept attacker-controlled input without adequate bounds checking or type validation. Exploitation Path: A local attacker with standard user privileges opens a handle to the device exposed by the driver and issues crafted IOCTL calls with malicious parameters. The lack of input validation allows the attacker to trigger memory corruption in kernel space, which can be exploited to achieve arbitrary code execution at ring 0 (kernel level) or cause a system crash (blue screen of death). CVSS Vector Analysis: The vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H shows that while local access is needed, the attack is simple to execute and devastatingly effective — particularly in BYOVD scenarios where the attacker loads the vulnerable driver onto the target system as part of the attack chain.
Frequently Asked Questions
Is CVE-2015-2291 being actively exploited?
Yes, CVE-2015-2291 is actively exploited. CISA has confirmed exploitation in the wild by adding it to its Known Exploited Vulnerabilities catalog. This vulnerability is widely used in BYOVD (Bring Your Own Vulnerable Driver) attacks and has been associated with ransomware campaigns. Public exploit code is readily available.
What products are affected by CVE-2015-2291?
CVE-2015-2291 affects the Intel Ethernet Diagnostics Driver for Windows, specifically IQVW32.sys (32-bit) and IQVW64.sys (64-bit) versions prior to 1.3.1.0. However, due to BYOVD attack techniques, any Windows system can be affected if an attacker deploys the vulnerable driver, regardless of whether Intel Ethernet hardware is installed.
How do I fix CVE-2015-2291?
Update the Intel Ethernet Diagnostics Driver to version 1.3.1.0 or later, or remove it if unnecessary. More importantly, implement driver blocklisting through Windows Defender Application Control (WDAC) and enable Hypervisor-Protected Code Integrity (HVCI) to prevent BYOVD attacks. Monitor for any attempts to load the vulnerable driver files.
How severe is CVE-2015-2291?
CVE-2015-2291 carries a CVSS score of 7.8 (High severity) and grants kernel-level code execution. The EPSS score of 4.3% (88th percentile) confirms elevated exploitation probability. Its severity is amplified by the BYOVD attack vector and confirmed ransomware association, making it a critical threat that demands proactive mitigation even on systems without Intel Ethernet hardware.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.