BlackBerry discloses a critical flaw in QNX OS, impacting 200M+ cars, hospital equipment, more; sources say it resisted public disclosure until talks with CISA
A flaw in software made by BlackBerry has left two hundred million cars, along with critical hospital and factory equipment …
Politico
Context & Ripple Effects
QNX was already embedded in BlackBerry’s automotive strategy: the company had introduced Jarvis, a scanner for connected-car software flaws as a way to identify weaknesses in that software supply chain. The reported vulnerability turns security from a development-tool promise into an exposure across deployed systems.
Later coverage describes QNX as software controlling vehicle safety features and as a platform BlackBerry is extending toward robots. That makes the disclosure consequential beyond one vehicle population: the same trust and disclosure practices accompany QNX into additional safety-sensitive deployments.
First-order effects
BlackBerry must manage a critical QNX security incident affecting vehicle, hospital, and factory-equipment users, while its reported resistance to public disclosure puts its vulnerability-handling process under scrutiny from CISA and customers.
Manufacturers and operators using QNX in affected equipment must identify where the vulnerable software is deployed and coordinate their response with BlackBerry.
Second-order effects
Automakers and other equipment makers gain a stronger reason to require demonstrable software-security review from QNX and their suppliers, reinforcing the use case for tools such as BlackBerry’s connected-car code scanner.
CISA’s involvement raises the stakes for vendors whose vulnerabilities span critical systems: disclosure timing becomes part of the customer and regulator assessment, not merely a technical response detail.
Third-order effects
If QNX continues expanding from vehicles into robotics, as BlackBerry has positioned it to do in its robot operating-system push, each software flaw will carry consequences across a wider set of physical systems.
The episode points toward safety-critical software vendors being judged on lifecycle security and coordinated disclosure alongside the reliability of the operating system itself.
The trend: Embedded operating systems are becoming shared critical infrastructure, making vulnerability disclosure and software assurance central competitive requirements as deployments spread across physical industries.
After admitting that older (but still widely used) QNX versions were vulnerable, BlackBerry initially told CISA that it wanted to privately notify customers. But because of how QNX is sold and packaged into products, BlackBerry doesn't know everyone who uses it. https://twitter.c…
@chey_cobb
CyberSec Chey on x
Blackberry has been ducking reports that their QNX OS is vulnerable. It still powers cars, factories, medical devices, railroad equipment, US govt equipment, and certain parts of the Space Station. https://twitter.com/...
@hrbrmstr
@hrbrmstr on x
Ooof. QNX is...everywhere. Yet another situation where SBOM would be a big help. https://us-cert.cisa.gov/...
@icscert
Ics-Cert on x
🚨 BlackBerry disclosed its QNX #RTOS is affected by a #BadAlloc vulnerability—CVE-2021- 22156. Many BlackBerry QNX products are affected CVE-2021-22156. Follow @CISAgov's guidance: https://us-cert.gov/.... #VulnerabilityManagement https://twitter.com/...
@timclicks
Tim McNamara on x
Remember kids - companies that write systems software in safe languages don't expose hundreds of millions of users to security exploits. https://twitter.com/...
@0xbanana
@0xbanana on x
C and C++ aren't going away anytime soon but you can mitigate classes of vulnerabilities using a language like Rust. Let's start writing safer code everyone! #infosec #100DaysOfCode https://twitter.com/...
@ericgeller
Eric Geller on x
Remember the BadAlloc vulnerabilities in real-time operating systems and other software, disclosed in April? BlackBerry just announced that its QNX RTOS — used everywhere from cars and hospitals to the ISS — is vulnerable. https://support.blackberry.com/ ... https://us-cert.cisa.…
@jason_healey
Jay Healey on x
Awesome that @CISAgov had the oomph to push BlackBerry to take responsibility. Before CISA, especially when NSC lacked cyber coordinator under Trump, there might not have been a civilian cyber official to drive this result! https://twitter.com/...
@icscert
Ics-Cert on x
❗️ @CISAgov strongly encourages #criticalinfrastructure, #ICS owners and operators, and any other organization developing, maintaining, supporting, or using affected QNX-based systems to patch ASAP: https://us-cert.gov/.... #Cybersecurity #IoT #Software #OT