A vulnerability related to the use an insecure Platform Key (PK) has been discovered. An attacker with the compromised PK private key can create malicious UEFI software that is signed with a trusted key that has been compromised.
History

Mon, 09 Sep 2024 22:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H'}

cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H'}


Mon, 09 Sep 2024 21:30:00 +0000

Type Values Removed Values Added
References

Fri, 30 Aug 2024 20:45:00 +0000


Fri, 30 Aug 2024 09:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-1394
References
Metrics threat_severity

None

cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H'}

threat_severity

Important


Mon, 26 Aug 2024 19:45:00 +0000


Mon, 26 Aug 2024 19:30:00 +0000

Type Values Removed Values Added
Description A vulnerability related to the use an insecure Platform Key (PK) has been discovered. An attacker with the compromised PK private key can create malicious UEFI software that is signed with a trusted key that has been compromised.
Title Insecure Platform Key (PK) used in UEFI system firmware signature
References

cve-icon MITRE

Status: PUBLISHED

Assigner: certcc

Published: 2024-08-26T19:15:11.237Z

Updated: 2024-09-09T20:21:06.044Z

Reserved: 2024-08-22T19:50:07.296Z

Link: CVE-2024-8105

cve-icon Vulnrichment

Updated: 2024-08-30T16:02:49.517Z

cve-icon NVD

Status : Undergoing Analysis

Published: 2024-08-26T20:15:08.380

Modified: 2024-09-09T21:35:17.320

Link: CVE-2024-8105

cve-icon Redhat

Severity : Important

Publid Date: 2024-07-25T00:00:00Z

Links: CVE-2024-8105 - Bugzilla