FDA warns BlackBerry vulnerability may hit drug manufacturing, medical devices
A vulnerability known as “BadAlloc” in a widely used BlackBerry operating system may pose risks for pharmaceutical manufacturing equipment and certain medical devices, the US Food and Drug Administration said on Tuesday.FDA’s announcement was made alongside disclosures about the vulnerability from the US Cybersecurity and Infrastructure Security Agency (CISA) and BlackBerry detailing the vulnerability and providing information on mitigations to patch the problematic code.
The BadAlloc vulnerability was previously disclosed by CISA after being identified by researchers at Microsoft last April and affects software in numerous real-time operating systems (RTOS), including versions of Amazon’s FreeRTOS, Apache Nuttx OS and ARM’s Mbed OS.
In its statement, BlackBerry said that an integer overflow vulnerability affecting several older versions of its QNX operating system, which is widely used in manufacturing and medical equipment, “could potentially allow a successful attacker to perform a denial of service or execute arbitrary code.” The company said it is not aware of any real-world exploitations of the vulnerability.
FDA said that organizations impacted by the vulnerability should notify the agency of any products, equipment or systems that use the vulnerable RTOS and inform it of any potential impacts.
“FDA is not aware of any confirmed adverse events related to these vulnerabilities,” it said. “Manufacturers are assessing which equipment or systems may be affected by the BlackBerry QNX cybersecurity vulnerability, evaluating the risk, and developing mitigations, including deploying patches from BlackBerry.”
According to BlackBerry, the vulnerability has a Common Vulnerability Scoring System (CVSS V3) rating of 9.0 out 10, which falls in the critical range. The vulnerability is both remotely exploitable and of low attack complexity, CISA said.
FDA, CISA Alert, BlackBerry
