Insecure Platform Key (PK) used in UEFI system firmware signature

ronjor · Sep 2, 2024

Vulnerability Note VU#455367

Original Release Date: 2024-08-30 | Last Revised: 2024-08-30
Overview
A vulnerability in the user of hard-coded Platform Keys (PK) within the UEFI framework, known as PKfail, has been discovered. This flaw allows attackers to bypass critical UEFI security mechanisms like Secure Boot, compromising the trust between the platform owner and firmware and enabling manipulation of sensitive system settings.
Click to expand...

Solution
Update UEFI Firmware: Ensure you install the latest stable version of UEFI firmware provided by your PC vendor or the reseller of your computing environment. Refer to the Vendor Information section below for specific resources and updates from vendors addressing these vulnerabilities.
Click to expand...

Use Researcher Tools for Impact Assessment: Utilize tools and information provided by Binarly to assess the impact of untrusted Platform Keys on your systems. These resources can help you conduct a thorough analysis of affected systems
Click to expand...

.

Leverage Automatic Firmware Updates: If your operating system supports automatic or managed firmware updates (e.g., Linux Vendor Firmware Service, LVFS), regularly check for updates using fwupdmgr get-updates and apply them with fwupdmgr update or use Windows OEM supported mechanisms as appropriate. Keeping your firmware up to date is crucial in mitigating the risks associated with PKfail.
Click to expand...

EASTER · Sep 2, 2024

The PKFail vulnerability highlights a critical flaw in the UEFI ecosystem. While the Platform Key is expected to originate from the Original Equipment Manufacturer (OEM) using a secure hardware security module (HSM), in practice, much of the UEFI software and drivers are developed by a complex network of supply-chain partners and Independent BIOS Vendors (IBVs). These components are often shared across multiple OEMs. In some cases, temporary test software keys, or "softkeys," which are hard-coded for ease of build and testing, inadvertently make their way into production firmware.
Click to expand...

Log in or Sign up

Insecure Platform Key (PK) used in UEFI system firmware signature

ronjor Global Moderator

EASTER Registered Member

Log in or Sign up

Insecure Platform Key (PK) used in UEFI system firmware signature

ronjor Global Moderator

EASTER Registered Member

Useful Searches