CVE-2023-29063lowCWE-1299

CVE-2023-29063: low-severity vulnerability in Becton, Dickinson and Company (BD) FACSChorus

Lack of DMA Access Protections

Published · Updated

Follow this CVE+ Monitor FACSChorus

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 2.4epss 0.2%
In short

The FACSChorus workstation doesn't protect its PCI card slots from physical access, allowing someone to insert a device that captures memory and steal sensitive data like encryption keys.

Technical detail

The vulnerability results from insufficient DMA (Direct Memory Access) protections on PCIe slots, enabling an unauthenticated threat actor with physical access to insert a malicious PCI card that reads workstation RAM and extracts sensitive cryptographic material (e.g., BitLocker keys) during system startup, before IOMMU or SMMU protections are enforced.

Summary generated and translated by AI from the official description.
The FACSChorus workstation does not prevent physical access to its PCI express (PCIe) slots, which could allow a threat actor to insert a PCI card designed for memory capture. A threat actor can then isolate sensitive information such as a BitLocker encryption key from a dump of the workstation RAM during startup.
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Becton, Dickinson and Company (BD) · FACSChorus
Related CVEs — Becton, Dickinson and Company (BD) FACSChorus

In the same product, most dangerous first.

CVE-2023-29061MEDIUMLack of Adequate BIOS AuthenticationEPSS 0.4%CVE-2023-29060MEDIUMLack of USB WhitelistingEPSS 0.3%CVE-2023-29062LOWUnsecure Identity VerificationEPSS 0.3%CVE-2023-29065MEDIUMOverly Permissive Access PolicyEPSS 0.3%CVE-2023-29064MEDIUMHardcoded SecretsEPSS 0.3%CVE-2023-29066LOWIncorrect User ManagementEPSS 0.3%