Vulnerability

Philips lists VitalSky, PICiX and IntelliSpace Portal under TPM 2.0 flaws CVE-2023-1017 and CVE-2023-1018

MedDevice Cyber Staff · Mar 24 · 2 min read · Via Philips product security advisories, 2023 archive

Philips issued an advisory on March 24, 2023, for CVE-2023-1017 and CVE-2023-1018, two vulnerabilities in the TPM 2.0 Module Library of Microsoft Windows. Listed products are VitalSky, PICiX (all versions), CareEvent, Data Warehouse Connect, Monitoring as a Service (eMaaS) and IntelliSpace Portal.

Successful exploitation of CVE-2023-1017 can lead to denial of service, crashing the TPM chip or process or rendering it unusable, or to arbitrary code execution in the TPM context.

Code running in the TPM context sits beneath the operating system's protections, in the layer a host trusts to hold its keys.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Apply Microsoft's fixes for CVE-2023-1017 and CVE-2023-1018 to the listed Philips products as Philips validates them. Restrict local code execution on those hosts, since an attacker needs to reach the TPM interface first.

Apply validated updates. Install the Windows TPM fixes on VitalSky, PICiX, CareEvent and the other listed products per Philips guidance.
Check firmware too. Ask Philips whether TPM firmware updates from the hardware maker are also required.
Limit local execution. Block unapproved software on the listed hosts.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Named operating system

VitalSky

Named operating system

PICiX

Named operating system

CareEvent

Named operating system

Data Warehouse Connect

Named operating system

Monitoring as a Service (eMaaS)

Named operating system

IntelliSpace Portal

Named operating system

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Questions & Answers

Which Philips products are affected by CVE-2023-1017?

Philips listed VitalSky, PICiX (all versions), CareEvent, Data Warehouse Connect, Monitoring as a Service (eMaaS) and IntelliSpace Portal on March 24, 2023, for CVE-2023-1017 and CVE-2023-1018 in the Windows TPM 2.0 Module Library.

What can CVE-2023-1017 do?

Successful exploitation of CVE-2023-1017 can crash the TPM chip or process, render it unusable, or allow arbitrary code execution in the TPM context, per Philips' March 24, 2023 advisory.

← Back to Vulnerabilities