CVE-2024-8105
A vulnerability exists in UEFI implementations that use a hard-coded software-based Platform Key (PK). An attacker in possession of the corresponding PK private key can sign arbitrary UEFI executables or firmware components, causing them to be trusted by affected systems and potentially bypassing UEFI Secure Boot trust validation.
- Score
- CVSS 3.1 6.4 Medium
- Status
- Deferred - cret@cert.org
- Published
- 2024-08-26
- Last modified
- 2026-06-28
Affected products
- Altos R680 F4 (Acer)
- Altos R680s F4 (Acer)
- Aspire C22-1600 (Acer)
- Aspire S32-1856 (Acer)
- Aspire S 27 (Acer)
- Aspire Xc-1710 (Acer)
- C24-1655 (Acer)
- C24-962 (Acer)
- Vz2694g (Acer)
- Iaplx-detaa30 Test (Aopen)
- Ikblmux-dervolta Charging (Aopen)
- Alienware-13 (Dell)
- Alienware-13-laptop (Dell)
- Alienware-13-r2 (Dell)
- Alienware-15-r4 (Dell)
- Alienware-17-laptop (Dell)
- Alienware-17-r2 (Dell)
- Alienware-17-r3 (Dell)
- Alienware-alpha (Dell)
- Alienware-area51m-r2-laptop (Dell)
- Alienware-aurora-r11-desktop (Dell)
- Alienware-aurora-r13-desktop (Dell)
- Alienware-aurora-r14-desktop (Dell)
- Alienware-aurora-r15-amd-desktop (Dell)
- Alienware-aurora-r15-desktop (Dell)
- Alienware-aurora-r16-desktop (Dell)
- Alienware-m15-r2-laptop (Dell)
- Alienware-m17-r3-laptop (Dell)
- Alienware-m17-r4-laptop (Dell)
- Alienware-x14-r1-laptop (Dell)
- Alienware-x15-r1-laptop (Dell)
- Alienware-x17-r2-laptop (Dell)
- Inspiron-15-3502-laptop (Dell)
- Inspiron-15-3510-laptop (Dell)
- Inspiron-15-3521-laptop (Dell)
- Inspiron-15-5552-laptop (Dell)
- Inspiron-17-3782-laptop (Dell)
- Inspiron-17-5755-laptop (Dell)
- Inspiron-20-3059-aio (Dell)
- Inspiron-22-3263-desktop-aio (Dell)
- Inspiron-22-3265-desktop-aio (Dell)
- Inspiron-24-3455-aio (Dell)
- Inspiron-24-3464-aio (Dell)
- Inspiron-24-5459-aio (Dell)
- Inspiron-3250-small-desktop (Dell)
- Inspiron-3472-desktop (Dell)
- Inspiron-3646-small-desktop (Dell)
- Inspiron-3655-desktop (Dell)
- Inspiron-3656-desktop (Dell)
- Inspiron-3662-desktop (Dell)
- Inspiron-5680-gaming-desktop (Dell)
- Inspiron-one-23-2330-aio (Dell)
- Poweredge-c5230 (Dell)
- Vostro-20-3015-aio (Dell)
- Vostro-20-3052-aio (Dell)
- Vostro-24-5460-aio (Dell)
- Vostro-3252-small-desktop (Dell)
- Xps-8950-desktop (Dell)
- Xps-8960-desktop (Dell)
- Studio Sys Upd (Formelife)
- Au47 M1 (Fujitsu)
- Multiple (Fujitsu)
- Primergy Cx270 S2 (Fujitsu)
- Primergy Cx420 S1 Chassis (Fujitsu)
- Primergy Rx100 S7p (Fujitsu)
- Primergy Tx100 S3p (Fujitsu)
- Primergy Tx120 S3p (Fujitsu)
- B760m D2hx Lite Si Rev. 1.0 (Gigabyte)
- C621-sd8 (Gigabyte)
- C621-su8 Rev. 1.0 (Gigabyte)
- C621-wd12 (Gigabyte)
- C621-wd12-ipmi Rev. 1.0 (Gigabyte)
- C621 Aorus Xtreme Rev. 1.0 (Gigabyte)
- D120-c20 Rev. 230 (Gigabyte)
- E133-c10 (Gigabyte)
- E133-c10 Rev. Aaa1 (Gigabyte)
- E152-ze0 (Gigabyte)
- E152-ze1 Rev. A00 (Gigabyte)
- E162-220 (Gigabyte)
- E163-s30 Rev. Aab1 (Gigabyte)
- E163-z30 (Gigabyte)
- E251-u70 Rev. 100 (Gigabyte)
- E283-s90 Rev. Aad1 (Gigabyte)
- E283-z90 (Gigabyte)
- E283-z91 Rev. Aav1 (Gigabyte)
- El-20-3060-32g Rev. 1.0 (Gigabyte)
- El-30 Rev. 1.0 (Gigabyte)
- G1.sniper 3 Rev. 1.0 (Gigabyte)
- G1.sniper B7 (Gigabyte)
- G1.sniper M3 (Gigabyte)
- G1.sniper M7 Rev. 1.0 (Gigabyte)
- G1.sniper Z170 Rev. 1.0 (Gigabyte)
- G150-b10 Rev. 111 (Gigabyte)
- G152-z12 (Gigabyte)
- G152-z12 Rev. 200 (Gigabyte)
- G180-g00 Rev. 100 (Gigabyte)
- G182-c20 (Gigabyte)
- G190-g30 (Gigabyte)
- G190-h44 (Gigabyte)
- G191-h44 (Gigabyte)
References
- https://github.com/binarly-io/Vulnerability-REsearch/blob/main/PKfail/BRLY-2024-005.md
- https://kb.cert.org/vuls/id/455367
- https://security.ts.fujitsu.com/ProductSecurity/content/Fujitsu-PSIRT-FJ-ISS-2024-072412-Security-Notice.pdf
- https://uefi.org/specs/UEFI/2.9_A/32_Secure_Boot_and_Driver_Signing.html
- https://www.binarly.io/advisories/brly-2024-005
- https://www.gigabyte.com/us/Support/Security/2205
- https://www.intel.com/content/www/us/en/security-center/announcement/intel-security-announcement-2024-07-25-001.html
- https://www.supermicro.com/en/support/security_PKFAIL_Jul_2024
- https://www.kb.cert.org/vuls/id/455367
