CVE-2024-8105

Insecure Platform Key (PK) used in UEFI system firmware signature

View on CVE.org
Published Aug 26, 2024 CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability exists in UEFI implementations that use a hard-coded software-based Platform Key (PK). An attacker in possession of the corresponding PK private key can sign arbitrary UEFI executables or firmware components, causing them to be trusted by affected systems and potentially bypassing UEFI Secure Boot trust validation.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2024-48941 A vulnerability related to the use an insecure Platform Key (PK) has been discovered. An attacker with the compromised PK private key can create malicious UEFI software that is signed with a trusted key that has been compromised.
History
Type Values Removed Values Added
Description A vulnerability related to the use an insecure Platform Key (PK) has been discovered. An attacker with the compromised PK private key can create malicious UEFI software that is signed with a trusted key that has been compromised. A vulnerability exists in UEFI implementations that use a hard-coded software-based Platform Key (PK). An attacker in possession of the corresponding PK private key can sign arbitrary UEFI executables or firmware components, causing them to be trusted by affected systems and potentially bypassing UEFI Secure Boot trust validation.
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H'}

 cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H'}
Type Values Removed Values Added
References
Type Values Removed Values Added
Weaknesses CWE-1394
References
Metrics threat_severity

None

 cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H'}

threat_severity

Important
Type Values Removed Values Added
Description A vulnerability related to the use an insecure Platform Key (PK) has been discovered. An attacker with the compromised PK private key can create malicious UEFI software that is signed with a trusted key that has been compromised.
Title Insecure Platform Key (PK) used in UEFI system firmware signature
References
Earlier changes (3)

Subscriptions

No data.

Weaknesses

Sources

Status
PUBLISHED
Assigner
certcc
Published
Updated
Jun 28, 2026, 8:20 PM
Reserved
Aug 22, 2024, 7:50 PM

View source JSON

Updated
Aug 30, 2024, 4:02 PM

JSON

Status
Deferred
Published
Aug 26, 2024, 8:15 PM
Modified
Jun 28, 2026, 9:16 PM

View source JSON

Severity
Important
Public date
Jul 25, 2024, 12:00 AM

View source Bugzilla JSON

No data.