Security News > 2024 > August > CrowdStrike Reveals Root Cause of Global System Outages
![CrowdStrike Reveals Root Cause of Global System Outages](/static/build/img/news/crowdstrike-reveals-root-cause-of-global-system-outages-medium.jpg)
Cybersecurity company CrowdStrike has published its root cause analysis detailing the Falcon Sensor software update crash that crippled millions of Windows devices globally.
Specifically, it's related to a problematic content update deployed over the cloud, describing it as a "Confluence" of several problems that led to a crash: A mismatch between the 21 inputs passed to the Content Validator via the IPC Template Type as opposed to the 20 supplied to the Content Interpreter.
"At the next IPC notification from the operating system, the new IPC Template Instances were evaluated, specifying a comparison against the 21st input value. The Content Interpreter expected only 20 values. Therefore, the attempt to access the 21st value produced an out-of-bounds memory read beyond the end of the input data array and resulted in a system crash."
Besides validating the number of input fields in the Template Type at sensor compile time to address the issue, CrowdStrike said it also added runtime input array bounds checks to the Content Interpreter to prevent out-of-bounds memory reads and corrected the number of inputs provided by the IPC Template Type.
"Providing up-to-date security content to these kernel capabilities enables the sensor to defend systems against a rapidly evolving threat landscape without making changes to kernel code. Rapid Response Content is configuration data; it is not code or a kernel driver."
The release of the root cause analysis comes as Delta Air Lines said it has "No choice" but to seek damages from CrowdStrike and Microsoft for causing massive disruptions and costing it an estimated $500 million in lost revenue and extra costs related to thousands of canceled flights.
News URL
https://thehackernews.com/2024/08/crowdstrike-reveals-root-cause-of.html
Related news
- CrowdStrike update crashes Windows systems, causes outages worldwide (source)
- Update: Worldwide IT outage due to buggy Crowdstrike sensor configuration update (source)
- Week in review: CrowdStrike update causes widespread IT outage, critical Splunk Enterprise flaw (source)
- Administrators have update lessons to learn from the CrowdStrike outage (source)
- CrowdStrike: Buggy Validator Started Massive Outage (source)
- The CrowdStrike Outage and Market-Driven Brittleness (source)
- Week in review: CrowdStrike-triggered outage insights, recovery, and measuring cybersecurity ROI (source)
- Some good may come out of the CrowdStrike outage (source)
- CrowdStrike sued by investors over massive global IT outage (source)
- Crowdstrike: Delta Air Lines refused free help to resolve IT outage (source)