CVE-2024-56738

A flaw was found in GRUB2. Affected versions of GRUB2 do not use a constant-time algorithm for grub_crypto_memcmp, which can allow side-channel attacks.

Due to the extremely limited conditions needed for exploitation, this vulnerability is classified as low severity. Due to GRUB using libgcrypt during HTTPS operations, there is potential for a side-channel attack that could enable an attacker to infer TLS session key information. However, because GRUB runs in a single-threaded context during boot, it eliminates the common attack vector of timing measurements across threads, so it reduces the potential for exploitation in most situations. Additionally, many configurations offload HTTPS/TLS handling to UEFI or do not enable libgcrypt for HTTPS at all, leaving the vulnerable code path unused.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.