Vulnerability

J&J Surgical Vision systems run QNX versions with BadAlloc flaw CVE-2021-22156

MedDevice Cyber Staff · Sep 24 · 2 min read · Via J&J statement on QNX BadAlloc

Johnson & Johnson published a statement on September 24, 2021 on BlackBerry's QNX BadAlloc vulnerability, CVE-2021-22156, an integer overflow in the calloc() function. J&J Surgical Vision products running affected QNX versions are the IFS Advanced Femtosecond Laser, the COMPACT INTUITIV System, SOVEREIGN COMPACT, the WHITESTAR SIGNATURE PRO System and the VERITAS Vision System.

J&J determined the risk is controlled and is working on compensating controls or mitigations. No fixed software is named.

Real-time operating systems sit under the application and rarely appear in a customer's asset view. BadAlloc is a reminder to ask every supplier which RTOS and which version ships in the box.

Are you a representative of Johnson & Johnson Surgical Vision or Johnson & Johnson MedTech? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

J&J names no software fix for CVE-2021-22156 in its Surgical Vision products and rates the risk controlled. Follow J&J for compensating controls and keep the systems off general networks in the meantime.

List QNX based systems. Identify IFS, COMPACT INTUITIV, SOVEREIGN COMPACT, WHITESTAR SIGNATURE PRO and VERITAS units.
Keep them isolated. Hold the systems off general hospital networks until J&J issues mitigations.
Track J&J guidance. Watch the J&J product security page for the compensating controls it is preparing.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Named operating system

VERITAS Vision System

PID-23 Named operating system

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Questions & Answers

Which Johnson & Johnson Surgical Vision products are affected by QNX BadAlloc?

J&J's statement of September 24, 2021 lists the IFS Advanced Femtosecond Laser, COMPACT INTUITIV System, SOVEREIGN COMPACT, WHITESTAR SIGNATURE PRO System and VERITAS Vision System as running QNX versions with CVE-2021-22156.

Is there a fix for CVE-2021-22156 on VERITAS and WHITESTAR systems?

J&J's September 24, 2021 statement names no fixed software. It rates the risk controlled and says J&J is working on compensating controls or mitigations.

← Back to Vulnerabilities