CVE-2024-56738: Medium severity GNU GRUB vulnerability
Published Dec 29, 2024
·Updated
GNU GRUB (aka GRUB2) through 2.12 does not use a constant-time algorithm for grubcryptomemcmp and thus allows side-channel attacks.
Affected Software
7 affected components
GNU GRUB<2.12
GNU GRUB2<=2.12
Microsoft cbl2 grub2 2.06-16
Microsoft cbl2 grub2 2.06-15
Microsoft azl3 grub2 2.06-25
Microsoft azl3 grub2 2.06-24
Microsoft cbl2 grub2 2.06-14
Event History
Dec 29, 2024
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionWeakness
Data Sourced
via NVD·07:15 AM
DescriptionSeverityWeaknessAffected Software
Sep 3, 2025
Data Sourced
via Microsoft·10:01 PM
DescriptionSeverityWeaknessAffected Software
Updated
via Microsoft·10:01 PM
Affected Software
Sep 4, 2025
Updated
via Microsoft·05:01 AM
DescriptionSeverity
Feb 20, 58733
Event
via Microsoft·02:50 PM
Frequently Asked Questions
1
What is the severity of CVE-2024-56738?
CVE-2024-56738 is rated as a high-severity vulnerability due to its potential for facilitating side-channel attacks.
2
How do I fix CVE-2024-56738?
To mitigate CVE-2024-56738, update GNU GRUB to version 2.12 or later as this version implements a constant-time comparison function.
3
What are the risks associated with CVE-2024-56738?
CVE-2024-56738 may allow attackers to infer secrets from the system by exploiting timing discrepancies in memory comparison operations.
4
Which versions of GNU GRUB are affected by CVE-2024-56738?
CVE-2024-56738 affects all versions of GNU GRUB prior to version 2.12.
5
Is there a workaround for CVE-2024-56738 until I can update?
No official workaround is provided for CVE-2024-56738; the best practice is to update to the latest version as soon as possible.