CVE-2024-8105

Vulnerability

Description PKfail (CVE-2024-8105) stems from the use of hard-coded test keys, known as softkeys, in production UEFI firmware. These keys were intended only for testing but were inadvertently shipped, making their private keys accessible to attackers [1][3]. The Platform Key (PK) is meant to establish trust between the platform owner and firmware, but the use of insecure keys undermines this trust [4].

Exploitation

An attacker who obtains the compromised PK private key can sign malicious UEFI binaries as if they were trusted. This allows bypassing Secure Boot enforcement, enabling the execution of untrusted code during the boot process [1][2]. The attack does not require physical access if the key is obtained remotely (e.g., from leaked firmware images or compromised development environments).

Impact

Successful exploitation enables persistent, low-level compromise of the system. Attackers can install bootkits, modify UEFI variables, and subvert operating system security mechanisms. The vulnerability affects a wide range of devices from multiple vendors, including Acer, Dell, and Aopen, as documented in the reference [1].

Mitigation

Intel has issued a security announcement [2], and CERT/CC has published a vulnerability note [3][4]. Mitigations include updating firmware with properly generated Platform Keys from a secure hardware security module (HSM). Affected vendors are expected to provide firmware updates that replace the insecure keys.