CVE-2023-52611 is a vulnerability in the Linux kernel's rtw88 WiFi driver, specifically affecting the SDIO interface used by certain Realtek RTL8822CS combo WiFi/Bluetooth cards. The issue arises from the interaction between the driver and the hardware limitations of the Amlogic A311D (G12B) SoC's SDIO controller, which has a hardware bug preventing direct DMA transfers. Instead, all data transfers must go through the controller's SRAM, limiting the maximum transfer size to 1536 bytes. The rtw88 driver originally did not honor the host's maximum request size (max_req_size) in the RX path, leading to skb_over_panic errors when packets larger than this limit were received or when RX aggregation caused multiple packets to be transferred in a single MMC/SDIO transaction. This could cause kernel panics or crashes due to buffer overruns. The vulnerability was identified through observations on Banana Pi BPI-CM4 devices using the affected hardware. The fix involves modifying the rtw88 driver to perform multiple consecutive reads in the rtw_sdio_read_port() function, effectively splitting large incoming packets or aggregated packets into smaller chunks that respect the host's max_req_size. Additionally, the fix includes draining remaining data from the card's buffer in case of receive errors to prevent corrupt data from being processed in subsequent reads. This patch eliminates the skb_over_panic errors and stabilizes the RX path for affected devices. No known exploits are currently reported in the wild, and the vulnerability is specific to hardware using the RTL8822CS SDIO WiFi/Bluetooth combo card on platforms with the Amlogic A311D SoC or similar hardware exhibiting the same SDIO controller limitations.

For European organizations, the impact of CVE-2023-52611 primarily concerns systems and embedded devices running Linux kernels with the affected rtw88 driver and using the RTL8822CS SDIO WiFi/Bluetooth combo card, particularly on hardware platforms like the Banana Pi BPI-CM4 or other devices with the Amlogic A311D SoC. Such devices are often used in IoT, industrial control, or edge computing scenarios. The vulnerability can cause kernel panics or system instability due to skb_over_panic errors, leading to denial of service (DoS) conditions. This can disrupt critical network connectivity, especially in environments relying on wireless communication for operational continuity. While the vulnerability does not appear to allow privilege escalation or remote code execution, the resulting instability can impact availability and reliability of affected systems. European organizations deploying embedded Linux devices with these hardware components may experience operational disruptions, increased maintenance overhead, and potential downtime. Since no known exploits exist in the wild, the immediate risk is moderate, but unpatched systems remain vulnerable to accidental crashes or targeted attacks exploiting this flaw to cause DoS.

To mitigate CVE-2023-52611, European organizations should: 1) Identify and inventory devices using the RTL8822CS SDIO WiFi/Bluetooth combo card, especially those running on Amlogic A311D (G12B) SoC or similar hardware with SDIO controller limitations. 2) Apply the latest Linux kernel updates or patches that include the fix for honoring the host max_req_size in the rtw88 driver's RX path. This involves updating to kernel versions that incorporate the relevant commit addressing this issue. 3) For devices where kernel updates are not immediately feasible, consider disabling or limiting RX aggregation settings in the rtw88 driver as a temporary workaround to reduce the likelihood of skb_over_panic errors, though this does not fully resolve the problem. 4) Monitor system logs for skb_over_panic or -EILSEQ errors related to the rtw88 driver to detect potential issues early. 5) Engage with hardware vendors or device manufacturers to confirm support for patched drivers and firmware updates. 6) For critical deployments, conduct testing to validate stability post-patch and ensure that the fix does not introduce regressions. 7) Implement network segmentation and access controls to limit exposure of vulnerable devices to untrusted networks, reducing the risk of exploitation attempts causing denial of service.