Vulnerability · Published Aug 26, 2024 · Assigned by certcc
CVE-2024-8105Insecure Platform Key (PK) used in UEFI system firmware signature
Medium 6.4
In plain English
A medium-severity security flaw in altos r680 f4 from Acer. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).
Severity (CVSS 3.1)6.4Medium
Exploit odds (30 days)0.3%top 80.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability exists in UEFI implementations that use a hard-coded software-based Platform Key (PK). An attacker in possession of the corresponding PK private key can sign arbitrary UEFI executables or firmware components, causing them to be trusted by affected systems and potentially bypassing UEFI Secure Boot trust validation.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Acer | vz2694g | d61d0e09d008bfb29bc32532b1b94fcc4ee2af5e8372c6d38722a4e73ecc71d6 – before 0 |
| Acer | aspire s 27 | 2bd2bfaf79a72eaca45e544e5c6a5bb842b292bdc229b8975b3101a4013e0d5f |
| Acer | aspire s32-1856 | 29837e239487cc83818a7f40f9280d9692a50376487899edd603494b0f30e4c5 |
| Acer | aspire xc-1710 | cdaa406bda1a58fbe9933622dec218a26f79871d42f0d3576fbf878e51a16201 |
| Acer | c24-1655 | 399f68dc94a6c42030efcd57fd034ff721f860b7b5d447779e7a6a6c99aba34f |
| Acer | aspire c22-1600 | d938d08543d35d4249a51057c1d9c62bb1f6440af19913c5feffcea47dd3de95 |
| Acer | c24-962 | 3d525f96f63995c51ab1bcd2c50ebb71661ffeca9f78f97cc97e851d0e2bbbdd |
| Acer | altos r680 f4 | a2679a9595a104d70bddc024dbc4f65f0dc9d906f30a0d1ae6b996b14246a6c2 |
| Acer | altos r680s f4 | e5fdaabf11b236c5c7b040d674936e84db746a180ab9999317e16dcb77aeeba4 |
| Aopen | iAPLx-DE(TAA30 TEST) | 94c6f84946db100b505af8a308f69ef6cddc2e310b50641a6e2e63bc9aed54e0 |
| Aopen | iKBLMUx-DER(Volta Charging) | fcd339e12730f057e41ad41228f9612d4954f2d0dbcfeef37e14dcdaf2866e05 |
| Dell | inspiron-15-3510-laptop | 7fbfd8b03d178e074572dff764f28af98c87c7556ce3837ccb8dfe993efa1940 |
| Dell | alienware-x17-r2-laptop | 65f5939878deede2e1b24a6412ba025b78f45b1562e9d365d97e1c76a32a1832 |
| Dell | alienware-m17-r4-laptop | f75b595b9ce5e1e25a5d64e54edffdf696251b4f4e860c0d3a03a183631f090e |
| Dell | alienware-x14-r1-laptop | 620848eeadb74a572d6400672aecca35f46dfdc7b5152bb028fbcbf74ea7bccd |
| Dell | alienware-aurora-r15-amd-desktop | 6348442334e85e8374884ea848685771053a7cf274ccb77559c710b5a00f61e9 |
| Dell | alienware-m17-r3-laptop | 413a04c12bde19f1f97d9d334ed57197f0405f9f10ab7154d2b71e5471577c97 |
| Dell | alienware-area51m-r2-laptop | 253743e7a39d0b709122c5329799f4c4608536eeb632218e7f0cbe1f6e8b5db8 |
| Dell | alienware-x15-r1-laptop | 4fc54067f263791aed2fa4b57b226ea15c4eb0f55b3797e002bb62aa936bdd8c |
| Dell | inspiron-15-3521-laptop | e2242e4aa3a284fcbbcf2f38a10bec24408f1eff74bb307e699ea46f483359f2 |
| Dell | alienware-aurora-r11-desktop | 8f79d9de33f5f131226a78ccb10bb16218a5be51b2105cc32e38ceb0c8c30e9a |
| Dell | inspiron-15-3502-laptop | 62c02a9b5a4d4328ac41c3e3aa7757e64e6c5cd52b9e047333ad18e60d17fcb6 |
| Dell | alienware-aurora-r13-desktop | dc5912033c5ca14475f2d59ca47f25c8840f362f0c8553d13bb06a8e47c42abf |
| Dell | xps-8950-desktop | 6982be0bd8e1aed1251fe5300eec2b515b7cab70e761cfb72074f5d658d092d9 |
| Dell | alienware-aurora-r15-desktop | 7e310dca802db0f7a22d39bb2d7d5b79c7e9df8e5698f0e691942ec334ce5794 |
| Dell | alienware-aurora-r14-desktop | 26a447a94e96fa8d9c590888cae490750c32d5af95faece3595f21efc41c1f2c |
| Dell | alienware-aurora-r16-desktop | 06a9dffc8fb3edafd1b6377cf38879860a0ae3c87f97258e09d189d291f64ead |
| Dell | xps-8960-desktop | 0dcd7494f4926fb04b56e9713f0b62eff3a345b626fa2adaf47636bf0bb4c3eb |
| Dell | alienware-m15-r2-laptop | 69da86e9cf24c49496529f3041604a6bb1c0c0ab86c192239d31d3a9b92467cd |
| Dell | inspiron-17-3782-laptop | 602a23f43b11817ad5439579969753866a54b836f34dfe19342e5188cf088d85 |
References
- UEFI Forum Standards on SecureBoot and Driver Signing Advisory product, technical-description
- Binarly Finder's Advisory technical-description
- CERT/CC Advisory third-party-advisory
- Binarly Technical Description technical-description, signature
- Supermicro Advisory vendor-advisory
- Intel Advisory cum End-ofLife anouncement vendor-advisory
- Fujitsu Advisory vendor-advisory
- Gigabyte Advisory vendor-advisory
- https://www.kb.cert.org/vuls/id/455367