CVE-2024-8105
Description
The PKfail flaw was discovered in Secure Boot. It is a firmware supply-chain issue that affects hundreds of device models in the UEFI ecosystem. The Secure Boot "master key," known as the Platform Key, which manages the Secure Boot databases and maintains the chain of trust from firmware to the operating system, is often not replaced by OEMs or device vendors. This issue results in devices shipping with untrusted keys. This issue allows an attacker with access to the private part of the PK to bypass Secure Boot by manipulating the Key Exchange Key (KEK) database, the Signature Database (db), and the Forbidden Signature Database (dbx).
Statement
PKFail is a supply chain security issue in which an untrusted private key is used for firmware development and production devices. This helps attackers perform malicious operations due to many devices in the field connected to the same leaked key, used across multiple vendors for cryptographic data preservation. These encryption keys should ideally assure platform security of devices secured with Secure Boot. This vulnerability could allow an attacker to sign device firmware that can bypass the protections that Secure Boot enables, compromising the trust chain of the device firmware and operating system. Only privileged user with physical access or root access can use UEFI-update to do this.
We recommend upgrading system firmware (to the last), please contact your hardware vendor for further updates.
Mitigation
The fix for PKfail is straightforward: the compromised key needs to be replaced and device vendors need to ship a firmware update.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.2 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | High | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Changed | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | High | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Understanding the Weakness (CWE)
Authentication
Technical Impact: Gain Privileges or Assume Identity
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
