Intel · Ethernet Diagnostics Driver for Windows
The Intel Ethernet Diagnostics Driver for Windows contains a flaw in its IQVW32.sys (before 1.3.1.0) and IQVW64.sys (before 1.3.1.0) drivers, caused by improper input validation of certain IOCTL calls. A local user with low privileges can exploit it by sending a crafted IOCTL request (using one of the codes 0x80862013, 0x8086200B, 0x8086200F, or 0x80862007) to crash the system or possibly run arbitrary code with kernel privileges, requiring no user interaction.
(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cause a denial of service or possibly execute arbitrary code with kernel privileges via a crafted (a) 0x80862013, (b) 0x8086200B, (c) 0x8086200F, or (d) 0x80862007 IOCTL call.
First seen exploited 5 years after disclosure. Public exploit code (Exploit-DB) was available 2 years before disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
arbitrary code execution at kernel level
possibly execute arbitrary code with kernel privileges via a crafted
local user kernel driver IOCTL exploitation for privilege escalation; TRAM2 annotated sentence label
allows local users to cause a denial of service or possibly execute arbitrary code with kernel privileges
In addition to these loaders, the attacker also exploits CVE-2015-2291, an Intel driver vulnerability, to load a malicious driver designed to reduce the token integrity of Microsoft Defender.
The primary objective of this malware is to disable Microsoft Defender by deploying a malicious kernel mode driver (“bring your own vulnerable driver” or BYOVD method) via exploiting a vulnerable Intel driver (CVE-2015-2291) and then downloading and executing the third-stage payload.
crafted IOCTL crashes the kernel driver
allows local users to cause a denial of service
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2015-2291 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
The primary objective of this malware is to disable Microsoft Defender by deploying a malicious kernel mode driver (“bring your own vulnerable driver” or BYOVD method) via exploiting a vulnerable Intel driver (CVE-2015-2291) and then downloading and executing the third-stage payload.
4 passages name itOriginal (opens in a new tab) ↗
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.