Side-Channel Vulnerability in GNU GRUB Affects Multiple Versions
CVE-2024-56738

5.3MEDIUM

Key Information:

Vendor

Gnu
Status
Grub2
Vendor
CVE Published:
29 December 2024

What is CVE-2024-56738?

The vulnerability in GNU GRUB affects versions prior to 2.12 due to the use of a non-constant-time algorithm in the grub_crypto_memcmp function. This imperfection opens the door for potential side-channel attacks, where attackers might exploit differences in processing time to infer sensitive information. Such vulnerabilities can significantly compromise the security of boot processes and the overall integrity of systems relying on GRUB for initialization.

Affected Version(s)

GRUB2 2.00 <= 2.12

References

https://savannah.gnu.org/bugs/?66603

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.