CrowdStrike outage, 19 July 2024
The CrowdStrike outage of 19 July 2024: what failed, why, and what CrowdStrike changed, from its own incident report.
- Provider
- CrowdStrike
- Date
- Cause
- Software bug
- Regions
- Global (Windows hosts online 04:09-05:27 UTC)
CrowdStrike Falcon Channel File 291 Windows crashes (19 July 2024).
What happened. A Rapid Response Content update (Channel File 291) supplied a matching criterion for a 21st input field, but the sensor only provided 20 inputs. A logic error in the Content Validator let it through and the Content Interpreter did an out-of-bounds memory read, crashing Windows.
What changes. CrowdStrike added input-count validation and runtime bounds checks, staged deployment rings for content, customer control over Rapid Response updates, and third-party code reviews.
Questions
What caused the CrowdStrike outage in July 2024?
A Rapid Response Content update (Channel File 291) supplied a matching criterion for a 21st input field, but the sensor only provided 20 inputs.
Which services were affected?
CrowdStrike Falcon sensor for Windows (7.11+); affected Windows hosts crashed (BSOD).
Read how shared dependencies spread a failure in why one cloud outage can break unrelated apps, or browse the outage archive.
- Started (UTC)
- 2024-07-19 04:09 UTC
- Resolved (UTC)
- 2024-07-19 05:27 UTC
- Services affected
- CrowdStrike Falcon sensor for Windows (7.11+); affected Windows hosts crashed (BSOD)
- Incident report
- crowdstrike.com
- Sources
Source Link CrowdStrike incident report https://www.crowdstrike.com/wp-content/uploads/2024/08/Channel-File-291-Incident-Root-Cause-Analysis-08.06.2024.pdf Release time https://www.crowdstrike.com/en-us/blog/falcon-content-update-preliminary-post-incident-report/ Cause https://www.crowdstrike.com/wp-content/uploads/2024/08/Executive-Summary_Root-Cause-Analysis_Channel-File-291.pdf