CVE-2024-56738: Medium severity GNU GRUB vulnerability
Published Dec 29, 2024
·Updated
GNU GRUB (aka GRUB2) through 2.12 does not use a constant-time algorithm for grubcryptomemcmp and thus allows side-channel attacks.
Affected Software
11 affected components
GNU GRUB<2.12
GNU GRUB2<=2.12
Microsoft cbl2 grub2 2.06-16
Microsoft cbl2 grub2 2.06-15
Microsoft azl3 grub2 2.06-25
Microsoft azl3 grub2 2.06-24
Microsoft cbl2 grub2 2.06-14
debian/grub2*
debian/grub2*
debian/grub2*
debian/grub2<=2.06-13+deb12u2, <=2.06-13+deb12u1, <=2.12-9+deb13u2, <=2.14-4
Event History
Dec 29, 2024
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionWeakness
Data Sourced
via NVD·07:15 AM
DescriptionSeverityWeaknessAffected Software
Data Sourced
via OSV·07:15 AM
DescriptionSeverityAffected Software
Sep 3, 2025
Data Sourced
via Microsoft·10:01 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-56738?
CVE-2024-56738 is rated as a high-severity vulnerability due to its potential for facilitating side-channel attacks.
2
How do I fix CVE-2024-56738?
To mitigate CVE-2024-56738, update GNU GRUB to version 2.12 or later as this version implements a constant-time comparison function.
3
What are the risks associated with CVE-2024-56738?
CVE-2024-56738 may allow attackers to infer secrets from the system by exploiting timing discrepancies in memory comparison operations.
4
Which versions of GNU GRUB are affected by CVE-2024-56738?
CVE-2024-56738 affects all versions of GNU GRUB prior to version 2.12.
5
Is there a workaround for CVE-2024-56738 until I can update?
No official workaround is provided for CVE-2024-56738; the best practice is to update to the latest version as soon as possible.