PT-2024-5891 · Unknown · Uefi Firmware

Published 2024-08-26 · Updated 2024-11-08 · CVE-2024-8105

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions UEFI firmware (affected versions not specified)

Description A vulnerability related to the use of an insecure Platform Key (PK) has been discovered. An attacker with the compromised PK private key can create malicious UEFI software that is signed with a trusted key that has been compromised. This issue may allow an attacker to gain persistent access to devices such as PCs, servers, etc. with UEFI firmware, potentially compromising boot security and allowing the installation of malware. Millions of devices are potentially at risk due to this flaw in UEFI systems.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-1394

Related Identifiers

BDU:2024-06694

CVE-2024-8105

Affected Products

Uefi Firmware

References · 35

• https://security.ts.fujitsu.com/ProductSecurity/content/Fujitsu-PSIRT-FJ-ISS-2024-072412-Security-Notice.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-06694 · Security Note
• https://intel.com/content/www/us/en/security-center/announcement/intel-security-announcement-2024-07-25-001.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-8105 · Security Note
• https://supermicro.com/en/support/security_PKFAIL_Jul_2024 · Vendor Advisory
• https://gigabyte.com/us/Support/Security/2205 · Vendor Advisory
• https://github.com/binarly-io/Vulnerability-REsearch/blob/main/PKfail/BRLY-2024-005.md · Note
• https://twitter.com/zoomeye_team/status/1830973177134207139 · Twitter Post
• https://twitter.com/ohhara_shiojiri/status/1830848991808139588 · Twitter Post
• https://twitter.com/CVEnew/status/1828151495625245048 · Twitter Post
• https://uefi.org/specs/UEFI/2.9_A/32_Secure_Boot_and_Driver_Signing.html · Note
• https://twitter.com/transilienceai/status/1843836982826312040 · Twitter Post
• https://twitter.com/autumn_good_35/status/1836068384146178119 · Twitter Post
• https://t.me/pentestingnews/51010 · Telegram Post
• https://twitter.com/transilienceai/status/1845455363660972565 · Twitter Post