CVE-2015-2291

CVE-2015-2291 is an input-validation flaw (CWE-20) in the Windows kernel-mode driver files IQVW32.sys and IQVW64.sys that ship with Intel's Ethernet diagnostics software for Windows. It is triggered when the driver mishandles malformed or unexpected input (such as a crafted request from code running on the host), causing the affected Windows system to crash. An attacker gains denial of service — a system-wide crash or blue-screen — on any Windows machine where the vulnerable diagnostics drivers are installed, a technique CISA notes has been used in ransomware operations. Any Windows workstation or server running the Intel Ethernet Diagnostics Driver is affected. Exploitation is in the wild: CISA added the flaw to the KEV catalog on 2023-02-10 with known ransomware use; EPSS estimates a 9.0% probability of exploitation in the next 30 days (95th percentile), and no public PoC is known.

What to do: Inventory Windows hosts for the driver files IQVW32.sys and IQVW64.sys (including driver service entries) to determine exposure, then apply updated Intel Ethernet diagnostics/network drivers per Intel's instructions, as required by CISA's KEV listing. Given known ransomware use, prioritize high-value servers and endpoints where untrusted code or users run. Restricting local code execution to trusted users reduces exposure until updates are applied.