CVE-2024-56738: gnu grub2 Observable Timing Discrepancy
CVSS: 5.3v3.1MediumAnalyzed
AliasesSUSE-SU-2025:02705-1SUSE-SU-2025:02706-1SUSE-SU-2025:02724-1SUSE-SU-2025:02725-1SUSE-SU-2025:02727-1SUSE-SU-2025:02772-1SUSE-SU-2025:02813-1SUSE-SU-2025:20654-1UBUNTU-CVE-2024-56738DEBIAN-CVE-2024-56738openSUSE-SU-2025:15400-1
Published 29-12-2024Last modified 31-12-2024
Vulnerability summary
CVE-2024-56738 is a medium (CVSS 5.3) Observable Timing Discrepancy vulnerability in gnu grub2. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 33.1% of scored vulnerabilities.
CVSS score
5.3/10
010
Medium · v3.1 (CVE.org)EPSS score
0.40%
0%100%
Low · -0.01 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 4 · Related 4Timeline
- 29-12-2024PublishedVulnerability first disclosed.
- 31-12-2024Last modifiedVulnerability information updated.
Description
GNU GRUB (aka GRUB2) through 2.12 does not use a constant-time algorithm for grub_crypto_memcmp and thus allows side-channel attacks.
CVSS metrics
4 scores · 4 sources · 1 versionMedium 5.3Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
0.40%
Chance of exploitation in the next 30 days
Percentile
33%
Versus all other CVEs
30-day change
-0.01 pp
From 0.41% on 18-09-2026
18-09-202618-10-2026
EPSS score0.40%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-208Observable Timing DiscrepancyTwo separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
- CWE-203Observable DiscrepancyThe product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
Affected systems
Suse11 products
- grub2&distro=SUSE Linux Enterprise Micro 5.1< 2.04-150300.3.14.2
- grub2&distro=SUSE Linux Enterprise Micro 5.2< 2.04-150300.22.58.1
- grub2&distro=SUSE Linux Enterprise Micro 5.3< 2.06-150400.11.63.1
- grub2&distro=SUSE Linux Enterprise Micro 5.4< 2.06-150400.11.63.1
- grub2&distro=SUSE Linux Enterprise Micro 5.5< 2.06-150500.29.53.1
Ubuntu3 products
- grub2All versions (No fix recorded)
- grub2-signedAll versions (No fix recorded)
- grub2-unsignedAll versions (No fix recorded)
Opensuse2 products
- grub2&distro=openSUSE Leap 15.6< 2.12-150600.8.34.1
- grub2&distro=openSUSE Tumbleweed< 2.12-56.1
Debian1 product
- grub2All versions (No fix recorded)
Gnu1 product
- grub2≥ 2.00, ≤ 2.12 | ≤ 2.12
5 vendors · 18 products
