GNU GRUB (aka GRUB2) through 2.12 does not use a constant-time algorithm for grub_crypto_memcmp and thus allows side-channel attacks.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | No solution exists | May 15, 2025 | Dec 29, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade grub2-efi-x64Upgrade grub2-efi-x64-modulesUpgrade grub2-commonUpgrade grub2-toolsUpgrade grub2-tools-minimalUpgrade grub2-tools-extraUpgrade grub2-pc-modulesUpgrade grub2-tools-efiUpgrade grub2-pc | Sep 15, 2025 | Sep 9, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade grub2-tools-extraUpgrade grub2-toolsUpgrade grub2-tools-minimalUpgrade grub2-commonUpgrade grub2-efi-aa64Upgrade grub2-efi-aa64-modules | Oct 14, 2025 | Sep 9, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade grub2-efi-aa64Upgrade grub2-commonUpgrade grub2-efi-aa64-modulesUpgrade grub2-tools-extraUpgrade grub2-tools-minimalUpgrade grub2-tools | Sep 15, 2025 | Sep 9, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade grub2-toolsUpgrade grub2-commonUpgrade grub2-efi-aa64Upgrade grub2-efi-aa64-modulesUpgrade grub2-tools-extraUpgrade grub2-tools-minimal | Oct 24, 2025 | Sep 9, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Dec 29, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub