CVE-2024-8105

Insecure Platform Key (PK) used in UEFI system firmware signature

Medium · published August 26, 2024

CVSS v3.1
6.4
EPSS
0%
Percentile
18.8
In the wild
Unconfirmed
What it is

A vulnerability exists in UEFI implementations that use a hard-coded software-based Platform Key (PK). An attacker in possession of the corresponding PK private key can sign arbitrary UEFI executables or firmware components, causing them to be trusted by affected systems and potentially bypassing UEFI Secure Boot trust validation.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00274 · 18.8th percentile
Published
2024-08-26T19:15Z
EPSS history
Timeline
  • 26 AUG 19:15Z
    Insecure Platform Key (PK) used in UEFI system firmware signature
    cvelistv5