2469 matches found
PT-2024-7303 · Intel · Intel Processors
Name of the Vulnerable Software and Affected Versions: IntelR Processors affected versions not specified Description: The issue is related to a NULL pointer dereference in the UEFI firmware for some IntelR Processors. This may allow a privileged user to potentially enable escalation of privilege...
PT-2024-7324 · Intel · Intel Uefi Firmware
Name of the Vulnerable Software and Affected Versions: Intel UEFI Firmware affected versions not specified Description: The issue is related to improper input validation in UEFI firmware for some Intel processors, which may allow a privileged user to enable information disclosure or denial of...
PT-2024-7304 · Intel · Intel Uefi Firmware
Name of the Vulnerable Software and Affected Versions: Intel UEFI Firmware affected versions not specified Description: The issue is related to an out-of-bounds read in the UEFI firmware of some Intel processors. This can potentially allow a privileged user to cause a denial of service via local...
PT-2024-7298 · Intel · Intel Uefi Firmware
Name of the Vulnerable Software and Affected Versions: Intel UEFI Firmware affected versions not specified Description: The issue is related to an untrusted pointer dereference in the UEFI firmware for some Intel reference processors. This could allow a privileged user to potentially enable...
PT-2024-7301 · Intel · Intel Uefi Firmware
Name of the Vulnerable Software and Affected Versions: Intel UEFI Firmware affected versions not specified Description: The issue is related to an out-of-bounds write in the UEFI firmware for some Intel processors. This could allow a privileged user to potentially enable escalation of privilege v...
CVE-2024-8105
A flaw was found in PKfail, a firmware supply-chain issue affecting hundreds of device models in the UEFI ecosystem. The Secure Boot "master key," known as the Platform Key, which manages the Secure Boot databases and maintains the chain of trust from firmware to the operating system, is often no...
Insecure Platform Key (PK) used in UEFI system firmware signature
Overview A vulnerability in the user of hard-coded Platform Keys PK within the UEFI framework, known as PKfail, has been discovered. This flaw allows attackers to bypass critical UEFI security mechanisms like Secure Boot, compromising the trust between the platform owner and firmware and enabling...
CVE-2024-8105
A vulnerability exists in UEFI implementations that use a hard-coded software-based Platform Key PK. An attacker in possession of the corresponding PK private key can sign arbitrary UEFI executables or firmware components, causing them to be trusted by affected systems and potentially bypassing...
CVE-2024-8105
A vulnerability exists in UEFI implementations that use a hard-coded software-based Platform Key PK. An attacker in possession of the corresponding PK private key can sign arbitrary UEFI executables or firmware components, causing them to be trusted by affected systems and potentially bypassing...
CVE-2024-8105
CVE-2024-8105 describes PKfail, a vulnerability where a compromised private Platform Key (PK) can sign malicious UEFI modules, allowing code execution at boot and potential bypass of Secure Boot. Public documents confirm the root cause is insecure PK usage in UEFI signatures, enabling attackers t...
CVE-2024-8105 Insecure Platform Key (PK) used in UEFI system firmware signature
A vulnerability exists in UEFI implementations that use a hard-coded software-based Platform Key PK. An attacker in possession of the corresponding PK private key can sign arbitrary UEFI executables or firmware components, causing them to be trusted by affected systems and potentially bypassing...
CVE-2024-8105 Insecure Platform Key (PK) used in UEFI system firmware signature
A vulnerability exists in UEFI implementations that use a hard-coded software-based Platform Key PK. An attacker in possession of the corresponding PK private key can sign arbitrary UEFI executables or firmware components, causing them to be trusted by affected systems and potentially bypassing...
SuperMicro BIOS 安全漏洞
SuperMicro BIOS is a software from SuperMicro, Inc. that is stored on a small memory chip on the motherboard. A security vulnerability exists in SuperMicro BIOS that stems from the use of an insecure platform key PK, where an attacker utilizing a compromised PK private key can create malicious UE...
PT-2024-5891 · Unknown · Uefi Firmware
Name of the Vulnerable Software and Affected Versions: UEFI firmware affected versions not specified Description: A vulnerability related to the use of an insecure Platform Key PK has been discovered. An attacker with the compromised PK private key can create malicious UEFI software that is signe...
OESA-2024-2023 edk2 security update
EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable function, allowing a user to trigger a heap buffer overflow via a local network. Successful...
CVE-2022-48919 cifs: fix double free race when mount fails in cifs_get_root()
In the Linux kernel, the following vulnerability has been resolved: cifs: fix double free race when mount fails in cifsgetroot When cifsgetroot fails during cifssmb3domount we call deactivatelockedsuper which eventually will call delayedfree which will free the context. In this situation we shoul...
Moderate: Red Hat Security Advisory: edk2 security update
An update for edk2 is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.6 Telecommunications Update Service. Red Hat Product Security has rated this update as havi...
RHEL 8 : edk2 (RHSA-2024:5623)
The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:5623 advisory. EDK Embedded Development Kit is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU a...
CVE-2024-43378
CVE-2024-43378 concerns calamares-nixos-extensions prior to version 0.3.17, where the installer’s legacy BIOS flow could leave the LUKS keyfile in plaintext in /crypto_keyfile.bin or in a CPIO archive attached to the NixOS initrd for partitions containing / or /boot. Red Hat and CVE records summa...