Vulnerability

Carestream lists DirectView V5.7 CR and DRX systems as impacted by Meltdown and Spectre

MedDevice Cyber Staff · Jan 5 · 2 min read · Via Carestream advisory CARESTREAM-XRS-2018-01

Carestream Health issued advisory CARESTREAM-XRS-2018-01 on January 5, 2018 on the Meltdown and Spectre speculative execution side channels, CVE-2017-5715, CVE-2017-5753 and CVE-2017-5754. It lists DIRECTVIEW Max, Classic and Elite CR systems and the Remote Operations Panel on DirectView V5.7 with Windows Embedded Standard 7 SP1, plus the DRX-Evolution, DRX-Evolution Plus, DRX-Ascend, DRX-1, DRX-Revolution and DRX-Mobile on DirectView V5.7, as impacted.

The Microsoft patch was still under evaluation, and Carestream reported no known instances of its equipment being impacted. Speculative execution bugs need code already running on the host, so on a locked-down radiography console the first line of defense is keeping untrusted code off it.

Are you a representative of Carestream Health? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Carestream was still evaluating the Microsoft Meltdown and Spectre patch for DirectView V5.7 at publication, so there was no validated fix yet. Keep untrusted software off the consoles and apply the Microsoft update once Carestream validates it.

Hold for validation. Do not apply the Microsoft patch to DirectView V5.7 systems until Carestream validates it.
Block untrusted code. Restrict software installation and removable media on DirectView consoles, since these attacks need local code execution.
Track the update. Watch the Carestream cybersecurity page for the validated patch and schedule installation.
Segment the consoles. Keep CR and DRX systems on a restricted imaging network.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Named operating system

DIRECTVIEW CR

PID-23 Named operating system

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
4D Integrated Treatment Console	Varian	Same named componentWindows Embedded Standard (= 7 SP1)	No feedback feed from manufacturer

Questions & Answers

Is Carestream DirectView V5.7 affected by Meltdown and Spectre?

Yes. Carestream advisory CARESTREAM-XRS-2018-01, issued January 5, 2018, lists DIRECTVIEW CR systems and DRX systems on DirectView V5.7 with Windows Embedded Standard 7 as impacted by CVE-2017-5715, CVE-2017-5753 and CVE-2017-5754.

Did Carestream release a Meltdown patch for DirectView?

At publication on January 5, 2018, Carestream was evaluating the Microsoft patch for DirectView V5.7 systems and reported no known instances of Carestream equipment being impacted by Meltdown or Spectre.

← Back to Vulnerabilities