CrowdStrike Outage – What Happened, Who Was Affected, and How to Fix It

What Happened?

On 19 July 2024, CrowdStrike, a leading cybersecurity firm, released an update for their Falcon sensor. This update inadvertently introduced a critical bug, leading to widespread Blue Screen of Death (BSOD) errors on Windows systems. The error, identified as "DRIVER_OVERRAN_STACK_BUFFER," has rendered many systems inoperable, causing significant disruptions.

Who Was Affected?

The impact of the CrowdStrike outage has been extensive, affecting multiple sectors and major organisations globally:

• Banks and Financial Institutions: Major banks experienced disruptions in transactional operations and customer services, affecting millions of customers.

  
  

• Supermarkets and Retail Chains: Large retail chains, including major supermarkets, faced issues with point-of-sale systems and inventory management, leading to long checkout times and inventory discrepancies.

• Media Companies and Broadcasters: Prominent media companies and broadcasters faced broadcast interruptions and digital service outages, impacting news dissemination and entertainment services.

• Educational Institutions: Universities and schools experienced downtime in online learning platforms and administrative systems, disrupting classes and administrative functions.

• Airlines and Airports: Numerous airlines reported flight cancellations and delays due to the outage. Initial reports indicate that over 500 flights were cancelled globally, causing widespread travel disruptions.

These sectors rely heavily on CrowdStrike's security solutions, highlighting the critical nature of the outage.

How Long Might Issues Occur?

The exact duration for which these issues might persist is currently unclear. CrowdStrike's engineering teams are working around the clock to develop a permanent fix. In the meantime, temporary workarounds are available to mitigate the impact. Users should keep an eye on CrowdStrike's official channels for the latest updates and technical alerts.

How to Solve Issues

While waiting for an official fix from CrowdStrike, users can apply the following workaround to address the BSOD issue:

1. Boot into Safe Mode with Networking:

   • Restart your system and repeatedly press the power button to interrupt the startup process until the Windows Recovery Environment appears.

   • Navigate to Troubleshoot > Advanced options > Startup Settings > Restart.

   • Select "Safe Mode with Networking" (Option 5 or F5).

2. Delete the Faulty Driver:

   • Once in Safe Mode, open File Explorer and navigate to C:\Windows\System32\drivers\CrowdStrike.

   • Locate the file named "C-00000291*.sys" and delete it.

3. Reboot Normally:

   • Restart your system normally to apply the changes.

CrowdStrike’s Response

CrowdStrike has acknowledged the issue and is advising users not to open individual support tickets. Instead, they should stay tuned to official communication channels for updates. The company is committed to resolving the issue swiftly and efficiently. Users are urged to exercise patience and follow the temporary workaround until a permanent solution is provided.

Conclusion

The recent CrowdStrike outage underscores the critical importance of rigorous testing in software updates, especially for cybersecurity solutions. While the temporary workaround can help mitigate the immediate impact, users should stay informed through CrowdStrike's updates to ensure their systems are fully operational and secure.