CVE-2024-8105

The PKfail flaw was discovered in Secure Boot. It is a firmware supply-chain issue that affects hundreds of device models in the UEFI ecosystem. The Secure Boot "master key," known as the Platform Key, which manages the Secure Boot databases and maintains the chain of trust from firmware to the operating system, is often not replaced by OEMs or device vendors. This issue results in devices shipping with untrusted keys. This issue allows an attacker with access to the private part of the PK to bypass Secure Boot by manipulating the Key Exchange Key (KEK) database, the Signature Database (db), and the Forbidden Signature Database (dbx).

PKFail is a supply chain security issue in which an untrusted private key is used for firmware development and production devices. This helps attackers perform malicious operations due to many devices in the field connected to the same leaked key, used across multiple vendors for cryptographic data preservation. These encryption keys should ideally assure platform security of devices secured with Secure Boot. This vulnerability could allow an attacker to sign device firmware that can bypass the protections that Secure Boot enables, compromising the trust chain of the device firmware and operating system. Only privileged user with physical access or root access can use UEFI-update to do this.

We recommend upgrading system firmware (to the last), please contact your hardware vendor for further updates.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

The fix for PKfail is straightforward: the compromised key needs to be replaced and device vendors need to ship a firmware update.