VMware Carbon Black causing BSOD crashes on Windows

guest · Aug 23, 2022

August 23, 2022

Windows servers and workstations at dozens of organizations started to crash earlier today because of an issue caused by certain versions of VMware’s Carbon Black endpoint security solution.

According to some reports, systems at more than 50 organizations started to display the dreaded blue screen of death (BSOD) a little after 15:00 (GMT+1) today.
Click to expand...

Faulty AV rule set
The root of the problem is a ruleset deployed today to Carbon Black Cloud Sensor 3.6.0.1979 - 3.8.0.398 that causes devices to crash and show a blue screen at startup, denying access to them.

Microsoft Windows operating systems impacted by the issue are Windows 10 x64, Server 2012 R2 x64, Server 2016 x64, and Server 2019 x64.
On systems impacted by the issue, the stop code may identify the error as "PFN_LIST_CORRUPT."
Click to expand...

One admin said that they had about “500 endpoints BSOD across our estate from approx 15:15 UK time.”
VMware explains in a knowledge base today that “an updated Threat Research ruleset was rolled out to Prod01, Prod02, ProdEU, ProdSYD, and ProdNRT after internal testing showed no signs of issues.”

An investigation is ongoing right now and the troublesome ruleset is being rolled back, which is expected to eliminate the problem.
Click to expand...

Update [August 23rd, 17:50]: VMware has provided the following statement for BleepingComputer shortly after publishing the article:

"VMware Carbon Black is aware of an issue affecting a limited number of customer endpoints, where certain older sensor versions were impacted by an update of our behavioral preventative capabilities. The issue has been identified and corrected, and VMware Carbon Black is working with impacted customers."
Click to expand...

Log in or Sign up

VMware Carbon Black causing BSOD crashes on Windows

guest Guest

Log in or Sign up

VMware Carbon Black causing BSOD crashes on Windows

guest Guest

Useful Searches