CVE-2024-56738 Details
Description
GNU GRUB (aka GRUB2) through 2.12 does not use a constant-time algorithm for grub_crypto_memcmp and thus allows side-channel attacks.
A side-channel vulnerability has been identified in GNU GRUB (GRUB2) versions through 2.12. The issue arises because the cryptographic memory comparison function 'grub_crypto_memcmp' does not utilize a constant-time algorithm, leaving it open to timing attacks. This vulnerability could be exploited in scenarios where GRUB commands are used to read arbitrary files or memory, potentially leaking sensitive information.
The vulnerability can be addressed by modifying the 'grub_crypto_memcmp' function to use a constant-time comparison algorithm. This fix has been proposed and tested on Debian systems. Alternatively, GRUB can be updated to a version that incorporates this fix.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Dec 31, 2024References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://savannah.gnu.org/bugs/?66603 | [email protected] | Issue TrackingThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-203 | Observable Discrepancy | [email protected] |
| CWE-208 | Observable Timing Discrepancy | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| gnu grub2 | <= 2.12 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 24, 2025 | Initial Analysis | [email protected] |
| Dec 31, 2024 | CVE Modified | CISA-ADP |
| Dec 29, 2024 | New CVE Received | [email protected] |