A list had 20 items. A rule asked for the 21st.

transcript

A list had 20 items. A rule asked for the 21st. That crashed about 8 point 5 million Windows machines.

February 2024. CrowdStrike's Falcon sensor gets a new rule form. The form defines 21 fields. The sensor only fills in 20. March and April. Four rules use this form. Nothing crashes. Then 19 July, 04:09 UTC. A new rule ships. Minutes later, Windows machines start going blue.

So why did four rules work? Each used a wildcard for field 21. Match anything means the sensor never reads box 21. July's rule said box 21 must match a real value. So the sensor reads box 21. There is no box 21. In a normal app, that's a crash. In the kernel, it's the whole machine.

But wait. There was a safety net. A content validator. It checked each rule against the spec. The spec said 21 fields. So field 21 looked perfectly valid. It shipped. The sensor supplied 20. The two files agreed. Reality didn't.

CrowdStrike called it configuration data. Not code. Literally true. But that data told kernel code which memory to read. It didn't contain the bug. It switched it on.

So test config like code. Give every field a real value. If your tests only say match anything, you never tested matching. Config is code.

Full breakdown in the lecture.