One CrowdStrike content update crashed an estimated 8.5 million Windows computers.

CrowdStrike's Falcon sensor is security software that runs partly as a Windows kernel driver, deep inside the operating system. Besides normal software releases, it receives Rapid Response Content from the cloud: detection rules that, in CrowdStrike's words, work "without requiring sensor code changes". Each set of rules plugs into a Template Type built into the sensor.

In February 2024, sensor version 7.11 added a Template Type for spotting attacks that abuse Windows named pipes (one way programs talk to each other). Its definition said it took 21 input fields. The sensor code that fed it supplied only 20.

Nobody noticed, because nothing looked at the 21st field. The tests, and the rule sets shipped from 5 March through April, all put a wildcard there: "match anything".

On 19 July 2024 at 04:09 UTC, two new rule sets went out in Channel File 291. One used a real value for the 21st field. The Content Validator checked it against the 21-field definition and passed it. On each Windows machine that got the file, the sensor went to read input 21, read past the end of a 20-item list, and crashed Windows with a blue screen.

CrowdStrike reverted the file at 05:27 UTC. Windows hosts on sensor 7.11 or later that were online in those 78 minutes were hit; Mac and Linux hosts were not. Microsoft estimated 8.5 million Windows devices were affected, "less than one percent of all Windows machines".

The fixes CrowdStrike listed: check the field count when the sensor is built, add a bounds check on every read, test real values and not only wildcards, and roll out rule content in stages: canary machines first, then wider rings, with customers given more control over when updates arrive.

Why it matters: Rules and config that can crash a machine are code. Give them the same staged rollout as a release, and never let a reader trust that its input is as long as it expects.