News for hackers. Stuff that matters.

A comment on CrowdStrike ex-employees: 'Quality control was not part of our process'. Parent comment

Re:CrowdStrike ex-employees: 'Quality control was not part o... by Izkata on Saturday September 14, 2024 @02:49PM (#41541941)
> Obviously the system wasn't very robust, as a simple, within specs change could break it.

From my limited understanding, the file was corrupted in some way. Lots of NULL bytes, something like that.

[ Parent | on HN ]
Re:CrowdStrike ex-employees: 'Quality control was not part o... by acdha on Saturday September 14, 2024 @03:00PM (#41542008)
That rumor floated around Twitter but the company quickly disavowed it. The problem was that they added an extra parameter to a common function but never tested it with a non-wildcard value, revealing a gap in their code coverage review:

https://www.crowdstrike.com/wp-content/uploads/2024/08/Chann...

[ Parent | on HN ]
Re:CrowdStrike ex-employees: 'Quality control was not part o... by GuB-42 on Saturday September 14, 2024 @02:58PM (#41541996)
From the report, it seems the problem is that they added a feature that could use 21 arguments, but there was only enough space for 20. Until now, no configuration used all 21 (the last one was a wildcard regex, which apparently didn't count), but when they finally did, it caused a buffer overflow and crashed.
[ Parent | on HN ]