UEFI Vulnerability Due to Insecure Platform Key

CVE-2024-8105

What is CVE-2024-8105?

A significant vulnerability has been identified related to the use of compromised Platform Key (PK) within UEFI firmware. Attackers who gain access to the compromised PK private key can potentially create and deploy malicious UEFI software, which can subsequently be signed with a trusted key, allowing it to bypass security mechanisms. This exploitation poses a considerable threat to system integrity and security, enabling unauthorized access and control over affected devices. Various vendors, including Intel, Supermicro, Fujitsu, and Gigabyte, are impacted, highlighting the need for immediate attention to firmware security practices.

References