CVE-2024-8105: Critical UEFI Vulnerability

CVE-2024-8105, known as PKfail, is a UEFI vulnerability in which test Platform Keys hard-coded into production firmware let an attacker who holds the private key sign code that affected systems trust, potentially bypassing Secure Boot. The CVE record lists vendors including Acer, Dell, HP, Intel and Lenovo. The fix is to update UEFI firmware from your device maker.

CVE-2024-8105, also known as “PKfai,” is a significant vulnerability identified within the UEFI (Unified Extensible Firmware Interface) ecosystem. With a CVSS score of 6.4 (medium), this flaw weakens critical UEFI security mechanisms, making systems vulnerable to malicious attacks that can bypass fundamental protections like Secure Boot.

What is UEFI and what role does it play?

UEFI is a vital component that acts as an interface between a computer’s firmware and its operating system. It employs a Public Key Infrastructure (PKI) to establish trust among the platform owner, firmware, and the operating system, with the Platform Key (PK) serving as the foundation of this trust model. Ideally, these keys are securely generated and managed using Hardware Security Modules (HSMs) by Original Equipment Manufacturers (OEMs).

The Vulnerability:

However, the complexity of the modern supply chain, involving numerous Independent BIOS Vendors (IBVs) and third-party partners, has led to a lax implementation of security protocols. In practice, many UEFI software and drivers are developed using temporary test keys or “softkeys,” which are hard-coded into the firmware for development and testing purposes. Alarmingly, these softkeys have been inadvertently included in production firmware, creating a significant security loophole.

The PKfail vulnerability exploits these hard-coded, untrusted Platform Keys mistakenly shipped within production firmware. If attackers gain access to the private portions of these test keys, they can sign and execute malicious UEFI software with the highest privileges during the early boot phases of a system, even when Secure Boot is enabled.

What can attackers do with PKfail?

This unauthorized access allows attackers to:

• Bypass UEFI Security Features: Neutralize protections like Secure Boot, which are designed to prevent unauthorized software from loading during the boot process.
• Establish Persistent Malware: Install stealthy and resilient malware that can survive reboots and even operating system reinstalls, making detection and removal exceedingly difficult.
• Exfiltrate Sensitive Data: Create covert backdoors and communication channels to steal confidential information undetected.
• Cause System Disruption: Potentially damage hardware, corrupt data, or initiate permanent shutdowns of affected devices.

Major vendors such as Acer, Dell, HP, Intel, and Lenovo are among those impacted, potentially leaving millions of devices vulnerable.

Mitigation Strategies:

While CVE-2024-8105 poses a serious threat, organizations can take the following steps to mitigate the risk:

• Leverage Automatic Firmware Updates: Many operating systems, including Linux and Windows, support automatic firmware updates. Regularly checking for and applying updates using tools like fwupdmgr or OEM mechanisms is crucial for securing systems.

• Update UEFI Firmware: Ensure systems are running the latest version of UEFI firmware provided by the manufacturer. Vendors are already releasing updates to address this vulnerability.

• Assess the Impact Using Research Tools: Utilize tools provided by security researchers, such as Binarly, to assess the presence of untrusted Platform Keys and determine the vulnerability status of systems.

Conclusion:

Addressing the CVE-2024-8105 vulnerability is critical for maintaining system security. By taking proactive steps to update firmware and assess vulnerability, organizations can protect their devices from this serious threat.