5.3
Medium
CVE-2024-56738 GNU GRUB (aka GRUB2) through 2.12 does not use a constant-time algorithm for grub_crypto_memcmp and thus allows…
Description
GNU GRUB (aka GRUB2) through 2.12 does not use a constant-time algorithm for grub_crypto_memcmp and thus allows side-channel attacks.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| GRUB2 2.00 | 2.00 → 2.12 | No fix stated |
Other CVEs of GRUB2
The 10 CVEs of GRUB2 →
CVE-2026-97876
A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot…
6.4
Medium
CVE-2025-54770
Grub2: use-after-free in net_set_vlan
4.9
Medium
CVE-2025-61664
Grub2: missing unregister call for normal_exit command may lead to use-after-free
4.9
Medium
CVE-2025-61663
Grub2: missing unregister call for normal commands may lead to use-after-free
4.9
Medium