GNU GRUB (aka GRUB2) through 2.12 does not use a constant-time algorithm for grub_crypto_memcmp and thus allows side-channel attacks.

This issue requires that the attacker has privileges to access the grub console on EC2. Furthermore, GRUB runs in a single-threaded context during boot which eliminates the common attack vector of timing measurements across threads. We therefore consider this issue unlikely to be exploitable. As a result, Amazon Linux will not be providing fix to the CVE.