SB2016041116 - Privilege escalation in Intel Ethernet diagnostics driver for Windows

Description

This security bulletin contains information about 1 security vulnerability.

1) Buffer overflow (CVE-ID: CVE-2015-2291)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the 0x80862013, 0x8086200B, 0x8086200F, and 0x80862007 IOCTL calls in the Intel Ethernet diagnostics driver for Windows. A local user can trigger memory corruption and execute arbitrary code with elevated privileges.

Note, the vulnerability is being actively exploited in the wild since December 2022 by Scattered Spider (aka Roasted 0ktapus or UNC3944).

Remediation

Install update from vendor's website.

References

• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00051.html
• https://www.crowdstrike.com/blog/scattered-spider-attempts-to-avoid-detection-with-bring-your-own-vulnerable-driver-tactic/