High memory usage observed after updating to SEF Engine 1.10.

Products

• Endpoint Protection
• Endpoint Security

Issue/Introduction

After upgrading to SEF Engine version 1.10, Endpoint Protection (SEP) and Endpoint Security (SES) utilize an increasing amount of memory, which eventually leads to memory exhaustion and a system crash. 

Environment

14.3 RU4 or later. 
SEF Engine 1.10
SymEvnt.sys 1.10.0.142

The dates for the SEF 1.10 release were:

EAS Starting May 16, 2023
Phased Release Starting May 23, 2023
Full Release June 6, 2023

Cause

Fixed an issue where a memory leak could potentially occur when files are remotely opened on a system. 

• • RU1, RU2, and RU3 agents are not affected
  • RU4, RU6 and RU7 agents are only affected if they have the Application Hardening feature enabled.  
  • All RU5 agents are affected (with and without the Hardening feature enabled).

Resolution

• If you are on 14.3 RU6 or later, as a workaround, you can uninstall the App Hardening feature from Endpoint Protection or Endpoint Security.
• SEP 14.3 RU4 and RU5, developers have scheduled the new release for SEF 1.11 engine version in the following stages:

EAS - 7/27/23
Phased - 8/1/23
Full - 8/22/23

• 14.3 RU8 will have the code fixed onboard.