What’s Vulnerable › Vulnerabilities

CVE-2024-8105: Insecure Platform Key (PK) used in UEFI system firmware signature

• Severity: medium (CVSS 6.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-08-26 · updated 2026-06-28

Description

A vulnerability exists in UEFI implementations that use a hard-coded software-based Platform Key (PK). An attacker in possession of the corresponding PK private key can sign arbitrary UEFI executables or firmware components, causing them to be trusted by affected systems and potentially bypassing UEFI Secure Boot trust validation.

Affected products

• Acer altos r680 f4: a2679a9595a104d70bddc024dbc4f65f0dc9d906f30a0d1ae6b996b14246a6c2
• Acer altos r680s f4: e5fdaabf11b236c5c7b040d674936e84db746a180ab9999317e16dcb77aeeba4
• Acer aspire c22-1600: d938d08543d35d4249a51057c1d9c62bb1f6440af19913c5feffcea47dd3de95
• Acer aspire s32-1856: 29837e239487cc83818a7f40f9280d9692a50376487899edd603494b0f30e4c5
• Acer aspire s 27: 2bd2bfaf79a72eaca45e544e5c6a5bb842b292bdc229b8975b3101a4013e0d5f
• Acer aspire xc-1710: cdaa406bda1a58fbe9933622dec218a26f79871d42f0d3576fbf878e51a16201
• Acer c24-1655: 399f68dc94a6c42030efcd57fd034ff721f860b7b5d447779e7a6a6c99aba34f
• Acer c24-962: 3d525f96f63995c51ab1bcd2c50ebb71661ffeca9f78f97cc97e851d0e2bbbdd
• Acer vz2694g: from d61d0e09d008bfb29bc32532b1b94fcc4ee2af5e8372c6d38722a4e73ecc71d6 before 0 — fixed in 0
• Aopen iAPLx-DE(TAA30 TEST): 94c6f84946db100b505af8a308f69ef6cddc2e310b50641a6e2e63bc9aed54e0
• Aopen iKBLMUx-DER(Volta Charging): fcd339e12730f057e41ad41228f9612d4954f2d0dbcfeef37e14dcdaf2866e05
• Dell alienware-13: fe9e2b75babda09ba22a3e99494198e125188d9345bda2b961f10e98e6c2b784
• Dell alienware-13-laptop: cb25317443d65ba126174c8b7547c7d2f6c0288f859e2063436eb7b350d9bf62
• Dell alienware-13-r2: e6819bd24e063807336994f36e1b7cafbbec46c2679a365dde1b54b720a049e4
• Dell alienware-15-r4: 608e410d1c0475dac58b1e8f36b477aa8d9e9f28d30ec89d44b550e36bbbaf47
• Dell alienware-17-laptop: d4ed519bd5e5ba2f027d00635494d485f19f3080d8baf6d711b190323294e216
• Dell alienware-17-r2: e94ccb36573d53127cfdf1f6d617c31ba8562fbdd4b43e48fe1fd52325315756
• Dell alienware-17-r3: 003130dabf11c8b5df286d9584b3174faa9529cd6149513d13c7ce85d63d97b0
• Dell alienware-alpha: f1d2c02737ba96e93892f38c161b3f35fbca79a4302e439e8405d3434ed88fdb
• Dell alienware-area51m-r2-laptop: 253743e7a39d0b709122c5329799f4c4608536eeb632218e7f0cbe1f6e8b5db8
• Dell alienware-aurora-r11-desktop: 8f79d9de33f5f131226a78ccb10bb16218a5be51b2105cc32e38ceb0c8c30e9a
• Dell alienware-aurora-r13-desktop: dc5912033c5ca14475f2d59ca47f25c8840f362f0c8553d13bb06a8e47c42abf
• Dell alienware-aurora-r14-desktop: 26a447a94e96fa8d9c590888cae490750c32d5af95faece3595f21efc41c1f2c
• Dell alienware-aurora-r15-amd-desktop: 6348442334e85e8374884ea848685771053a7cf274ccb77559c710b5a00f61e9
• Dell alienware-aurora-r15-desktop: 7e310dca802db0f7a22d39bb2d7d5b79c7e9df8e5698f0e691942ec334ce5794
• Dell alienware-aurora-r16-desktop: 06a9dffc8fb3edafd1b6377cf38879860a0ae3c87f97258e09d189d291f64ead
• Dell alienware-m15-r2-laptop: 69da86e9cf24c49496529f3041604a6bb1c0c0ab86c192239d31d3a9b92467cd
• Dell alienware-m17-r3-laptop: 413a04c12bde19f1f97d9d334ed57197f0405f9f10ab7154d2b71e5471577c97
• Dell alienware-m17-r4-laptop: f75b595b9ce5e1e25a5d64e54edffdf696251b4f4e860c0d3a03a183631f090e
• Dell alienware-x14-r1-laptop: 620848eeadb74a572d6400672aecca35f46dfdc7b5152bb028fbcbf74ea7bccd

How to fix

Upgrade to a fixed version: Acer vz2694g 0. Check the vendor advisory for mitigations.

References

• https://github.com/binarly-io/Vulnerability-REsearch/blob/main/PKfail/BRLY-2024-005.md
• https://kb.cert.org/vuls/id/455367
• https://security.ts.fujitsu.com/ProductSecurity/content/Fujitsu-PSIRT-FJ-ISS-2024-072412-Security-Notice.pdf
• https://uefi.org/specs/UEFI/2.9_A/32_Secure_Boot_and_Driver_Signing.html
• https://www.binarly.io/advisories/brly-2024-005
• https://www.gigabyte.com/us/Support/Security/2205
• https://www.intel.com/content/www/us/en/security-center/announcement/intel-security-announcement-2024-07-25-001.html
• https://www.supermicro.com/en/support/security_PKFAIL_Jul_2024
• https://www.kb.cert.org/vuls/id/455367

Get alerted when CVE-2024-8105 or the next vulnerability affects your stack