GNU GRUB (aka GRUB2) through 2.12 does not use a constant-time algorithm for grub_crypto_memcmp and thus allows side-channel attacks.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://savannah.gnu.org/bugs/?66603 | Issue Tracking Third Party Advisory |
Configurations
History
24 Jun 2025, 00:29
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Gnu grub2
Gnu |
|
| CPE | cpe:2.3:a:gnu:grub2:*:*:*:*:*:*:*:* | |
| CWE | CWE-203 | |
| References | () https://savannah.gnu.org/bugs/?66603 - Issue Tracking, Third Party Advisory |
29 Dec 2024, 07:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-12-29 07:15
Updated : 2025-06-24 00:29
NVD link : CVE-2024-56738
Mitre link : CVE-2024-56738
JSON object : View
Products Affected
gnu
- grub2
CWE
CWE-203
Observable Discrepancy