Vulnerability

Carestream lists ImageView DRX systems as affected by Chrome heap overflow CVE-2021-21148

MedDevice Cyber Staff · Feb 22 · 2 min read · Via Carestream advisory CARESTREAM-2021-01

Carestream Health published product security advisory CARESTREAM-2021-01 on February 22, 2021. It lists ImageView V1.8-1.X and V1.3-1.7 systems as affected by CVE-2021-21148, a heap buffer overflow in the V8 engine of Google Chrome before 88.0.4324.15 and Microsoft Edge before 88.0.705.63.

The affected list runs across the DRX line: DRX-Evolution, DRX-Evolution Plus, DRX-Ascend, Q-Rad, DRX Compass, DRX-1, DRX-Revolution, DRX-Revolution Nano, DRX-Mobile Retrofit, DRX Mobile Upgrade Solutions, DRX-Transportable and DRX-Transportable Lite. Carestream states the systems are impacted but mitigated by compensating controls, and that Chrome will be updated in the next software release.

A browser shipped on an X-ray console inherits the browser's patch cadence, and device release cycles rarely match it. Until the next release lands, the compensating controls carry the whole risk, so confirm they are in place on every console.

Are you a representative of Carestream Health? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Carestream names no patched ImageView build in CARESTREAM-2021-01; Chrome is due for update in the next software release. Until then the listed DRX systems rely on compensating controls against CVE-2021-21148. Confirm those controls on every affected console and install the release when Carestream ships it.

Inventory ImageView consoles. List every DRX system running ImageView V1.8-1.X or V1.3-1.7 and record its Chrome version.
Verify compensating controls. Check with Carestream service that the controls the advisory relies on are active on each console.
Limit browsing from the console. Keep the embedded browser off general web content and restrict its network reach to clinical endpoints.
Install the next release. Apply the Carestream software release that updates Chrome as soon as it is available.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Off-the-shelf software

ImageView

Off-the-shelf software

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2021-21148 in Carestream ImageView DRX systems?

CVE-2021-21148 is a heap buffer overflow in the V8 engine of Google Chrome before 88.0.4324.15 and Microsoft Edge before 88.0.705.63. Carestream advisory CARESTREAM-2021-01, published February 22, 2021, lists ImageView V1.8-1.X and V1.3-1.7 DRX systems as impacted but mitigated by compensating controls.

When will Carestream update Chrome on ImageView DRX systems?

Carestream advisory CARESTREAM-2021-01 of February 22, 2021 states Chrome will be updated in the next software release for ImageView V1.8-1.X and V1.3-1.7 systems. Until then, compensating controls mitigate CVE-2021-21148.

← Back to Vulnerabilities