Vulnerability

BD Alaris PC Unit can drop off hospital Wi-Fi through a Linux kernel flaw

MedDevice Cyber Staff · Jun 18 · 2 min read · Via CISA ICSMA-20-170-06

CISA published advisory ICSMA-20-170-06 on June 18, 2020, covering the Becton, Dickinson and Company (BD) Alaris PC Unit (PCU) at versions 9.13, 9.19, 9.33 and 12.1. BD reported the issue itself.

The flaw is CVE-2019-11479 (CWE-400), scored 5.3 under CVSS v3 with a network vector and no privileges required. The PCU incorporates a Linux kernel that is vulnerable to uncontrolled resource consumption due to a hard-coded maximum segment size overflow, and an attacker can use it to cause a denial of service.

The damage lands on the wireless function. CISA says successful exploitation could cause the Alaris PCU to disconnect from the facility's wireless network. The CVSS availability impact is rated low, which matches a network outage on the unit rather than a stopped infusion.

This is a third-party component problem, and BD treated it that way with a dedicated third-party product security bulletin on the Linux kernel in the PCU's Wi-Fi module. An infusion platform's network stack is only as current as the kernel the radio module shipped with, so it belongs in the SBOM review like any other dependency.

Are you a representative of BD? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Follow the BD third-party product security bulletin for the Linux kernel vulnerability in the Alaris PCU Wi-Fi module, which carries BD's recommended risk reductions for versions 9.13, 9.19, 9.33 and 12.1. Keep infusion pumps on a segmented wireless network so untrusted hosts cannot reach them. Plan for units dropping off Wi-Fi in your clinical workflow.

Apply BD's bulletin guidance. Use the controls in BD's third-party bulletin for CVE-2019-11479 on every affected PCU version.
Segment the infusion Wi-Fi. Put Alaris PCUs on a dedicated wireless network that general traffic cannot reach.
Track the kernel in the SBOM. Record the Wi-Fi module's Linux kernel as a component so future kernel advisories map to the PCU fleet.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Named operating system Off-the-shelf software

Contributing

Wireless connectivity Therapy delivery Hospital network

Alaris PC Unit

PID-23 Wireless connectivity Named operating system Off-the-shelf software

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

Which BD Alaris PC Unit versions are affected by CVE-2019-11479?

CISA advisory ICSMA-20-170-06, published June 18, 2020, lists BD Alaris PC Unit versions 9.13, 9.19, 9.33 and 12.1. The units incorporate a Linux kernel vulnerable to CVE-2019-11479, scored 5.3 under CVSS v3.

What happens if CVE-2019-11479 is exploited on a BD Alaris PCU?

Per CISA advisory ICSMA-20-170-06, exploiting CVE-2019-11479 could cause a denial of service and make the BD Alaris PC Unit disconnect from the facility's wireless network. BD published a third-party product security bulletin on the Linux kernel vulnerability in the PCU Wi-Fi module.

← Back to Vulnerabilities