Intel Ethernet diagnostics driver for Windows (iqvw64e.sys / iqvw32.sys), shipped with Intel network adapter tooling

Impact

A signed Intel kernel driver that exposes IOCTLs allowing arbitrary kernel memory read/write. This is the classic bring-your-own-vulnerable-driver primitive: an attacker who already has admin on a Windows host drops this legitimately signed Intel driver, loads it, and gets ring-0 - which they use to disable EDR, tamper with the boot chain, and install persistence. It is actively exploited in the wild (ransomware and intrusion crews). For a GPU operator running any Windows nodes, Windows-based fleet management, or Windows jump hosts on the management plane, this is a live escalation path from a compromised admin account to kernel and then to firmware tooling.

Who can reach it

Local administrator on a Windows host. The driver does not need to have been installed by you - the attacker brings the file, so the fleet's own driver inventory tells you nothing about exposure.

What to do

There is no patch to deploy in the useful sense, because the attack supplies its own copy of the driver. The fix is blocklisting: enable the Microsoft vulnerable-driver blocklist (HVCI / Windows Defender Application Control), which lists iqvw64e.sys, and enforce driver-signature and WDAC policy on every Windows node and management jump host. Also remove Intel's diagnostic/adapter tooling from golden images where it is not operationally needed. No reboot-and-drain cost on the Linux GPU fleet, but real policy work on the Windows management surface.

References