CVE-2023-52611

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtw88: sdio: Honor the host max_req_size in the RX path

Lukas reports skb_over_panic errors on his Banana Pi BPI-CM4 which comes

with an Amlogic A311D (G12B) SoC and a RTL8822CS SDIO wifi/Bluetooth

combo card. The error he observed is identical to what has been fixed

in commit e967229ead0e ("wifi: rtw88: sdio: Check the HISR RX_REQUEST

bit in rtw_sdio_rx_isr()") but that commit didn't fix Lukas' problem.

Lukas found that disabling or limiting RX aggregation works around the

problem for some time (but does not fully fix it). In the following

discussion a few key topics have been discussed which have an impact on

this problem:

- The Amlogic A311D (G12B) SoC has a hardware bug in the SDIO controller

which prevents DMA transfers. Instead all transfers need to go through

the controller SRAM which limits transfers to 1536 bytes

- rtw88 chips don't split incoming (RX) packets, so if a big packet is

received thi

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References