Vulnerability

BD rates Meltdown and Spectre low impact across its instrument and Pyxis lines

MedDevice Cyber Staff · Jan 5 · 3 min read · Via BD bulletin: Meltdown and Spectre

BD published a bulletin on January 5, 2018 on the Meltdown and Spectre hardware-based flaws, which could let malicious software reach other processes and their data. BD lists products in scope: Accuri C6 Gen II and C6 Plus, Alaris Systems Manager, Assurity Linc, BACTEC 9050, 9120/9240, FX and FX40, EpiCenter, the FACS cytometers, Kiestra InoqulA+, TLA and WCA, Phoenix 100, AP and M50, Pyxis products, Rowa Smart and Vmax, Totalys Slide Prep, Veritor Plus System and Viper LT.

BD rates the risk as low-impact and recommends patching and firmware updates for vulnerable products. The flaws need malicious code already running on the processor, so the first barrier is keeping untrusted code off the box.

A closed instrument that runs only its vendor's software has little to fear from a side channel. The rating falls apart the day someone installs a browser on it.

Are you a representative of BD? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

BD recommends patching and firmware updates for vulnerable products, per its January 5, 2018 bulletin, and rates the risk low-impact. Apply OS and firmware updates as BD validates them. Keep untrusted software off BD instruments so the precondition for these attacks never exists.

Apply validated updates. Install OS patches and firmware updates for Meltdown and Spectre on listed BD products as BD clears them.
Keep instruments closed. Allow only BD-supplied software to run on instrument workstations.
Check performance after patching. Confirm instrument timing and throughput after the updates, since processor mitigations can slow systems.

For Device ManufacturersFix the class in the product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
BD Alaris Infusion System with Guardrails Suite MX	BD	Names the affected product	No feedback feed from manufacturer

Questions & Answers

Which BD products are affected by Meltdown and Spectre?

BD's January 5, 2018 bulletin lists Accuri C6, Alaris Systems Manager, Assurity Linc, BACTEC, EpiCenter, FACS cytometers, Kiestra, Phoenix, Pyxis products, Rowa Smart and Vmax, Totalys Slide Prep, Veritor Plus System and Viper LT as in scope for Meltdown and Spectre.

How serious are Meltdown and Spectre for BD devices?

BD's January 5, 2018 bulletin rates the Meltdown and Spectre risk to its products as low-impact and recommends patching and firmware updates for vulnerable products.

← Back to Vulnerabilities