CVE-2024-56771 mtd: spinand: winbond: Fix 512GW, 01GW, 01JW and 02JW ECC information
A kernel warning triggers on bit flips in specific Winbond SPI NAND chips, potentially causing log spam or system instability.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-56771?
CVE-2024-56771 is a medium-severity denial of service vulnerability in Linux kernel, published on 8 Jan 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mtd: spinand: winbond: Fix 512GW, 01GW, 01JW and 02JW ECC information
These four chips: * W25N512GW * W25N01GW * W25N01JW * W25N02JW all require a single bit of ECC strength and thus feature an on-die Hamming-like ECC engine. There is no point in filling a ->get_status() callback for them because the main ECC status bytes are located in standard places, and retrieving the number of bitflips in case of corrected chunk is both useless and unsupported (if there are bitflips, then there is 1 at most, so no need to query the chip for that).
Without this change, a kernel warning triggers every time a bit flips.
Which versions are affected by CVE-2024-56771?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-56771?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-56771 being exploited?
There is no known exploitation of CVE-2024-56771 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-56771, DEBIAN-CVE-2024-56771, GHSA-w5c9-x85v-xrxm, UBUNTU-CVE-2024-56771.