多数のWindowsでブルースクリーンを発生させてしまったCrowdStrikeのコードは何が悪かったのか

I don't do Windows but here are some (initial) details about why the CrowdStrike's CSAgent.sys crashed

Faulting inst: mov r9d, [r8]
R8: unmapped address

...taken from an array of pointers (held in RAX), index RDX (0x14 * 0x8) holds the invalid memory address@_JohnHammond pic.twitter.com/oqlAVwSlJj

— Patrick Wardle (@patrickwardle) 2024年7月19日

The other "drivers" (e.g. 'C-00000291-...32.sys') appear to be obfuscated data ...and are x-ref'd (perhaps ingested?) by CSAgent.sys

...so maybe invalid (config/signature) data triggered the fault in CSAgent.sys

This would be easier to tell/confirm via debugging 😅 pic.twitter.com/AEOAFVT40i

— Patrick Wardle (@patrickwardle) 2024年7月19日

How to fix the Crowdstrike thing:

1. Boot Windows into safe mode
2. Go to C:\Windows\System32\drivers\CrowdStrike
3. Delete C-00000291*.sys
4. Repeat for every host in your enterprise network including remote workers
5. If you're using BitLocker jump off a bridge

— vx-underground (@vxunderground) 2024年7月19日

An update from @CrowdStrike confirms our analysis: https://t.co/2BpWVqOuMm

Namely:
▫ The C-...sys files aren't kernel drivers, but rather are "configuration files" dubbed "Channel Files"

▫ C-00000291- "triggered a logic error that resulted in an OS crash" (via CSAgent.sys)

— Patrick Wardle (@patrickwardle) 2024年7月20日

Note "channel updates ...bypassed client's staging controls and was rolled out to everyone regardless" https://t.co/UecaAmJdqc

A few IT folks who had set the CS policy to ignore latest version confirmed this was, ya, bypassed, as this was "content" update (vs. a version update)

— Patrick Wardle (@patrickwardle) 2024年7月19日