CVE-2024-8105
Insecure Platform Key (PK) used in UEFI system firmware signature
Using vz2694g by Acer?
Get instant alerts when new vulnerabilities affect vz2694g - before attackers find them.
Description
A vulnerability related to the use an insecure Platform Key (PK) has been discovered. An attacker with the compromised PK private key can create malicious UEFI software that is signed with a trusted key that has been compromised.
Affected
We have no canonical product record for this CVE. The source names may not have matched any product.
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
- https://security.ts.fujitsu.com/ProductSecurity/content/Fujitsu-PSIRT-FJ-ISS-2024-072412-Security-Notice.pdf
- https://www.gigabyte.com/us/Support/Security/2205
- https://www.intel.com/content/www/us/en/security-center/announcement/intel-security-announcement-2024-07-25-001.html
- https://www.supermicro.com/en/support/security_PKFAIL_Jul_2024
References (9)
SSVC — Action Prioritization
SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.
CVSS
- Attack Vector
- LOCAL
- Complexity
- HIGH
- Privileges
- HIGH
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality
- HIGH
- Integrity
- HIGH
- Availability
- HIGH
Quick Info
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.