GNU Grub2 up to 2.12 grub_crypto_memcmp timing discrepancy

Summaryinfo

A vulnerability has been found in GNU Grub2 up to 2.12 and classified as problematic. Affected by this issue is the function grub_crypto_memcmp. Performing a manipulation results in timing discrepancy. This vulnerability is cataloged as CVE-2024-56738. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability classified as problematic has been found in GNU Grub2 up to 2.12. This affects the function grub_crypto_memcmp. The manipulation with an unknown input leads to a timing discrepancy vulnerability. CWE is classifying the issue as CWE-208. Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not. This is going to have an impact on confidentiality. The summary by CVE is:

GNU GRUB (aka GRUB2) through 2.12 does not use a constant-time algorithm for grub_crypto_memcmp and thus allows side-channel attacks.

It is possible to read the advisory at savannah.gnu.org. This vulnerability is uniquely identified as CVE-2024-56738 since 12/29/2024. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 231890 (Linux Distros Unpatched Vulnerability : CVE-2024-56738), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Tenable (231890) and EUVD (EUVD-2024-53381). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• GNU

Name

• Grub2

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12

License

• open-source

Website

• Vendor: https://www.gnu.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion