EDR Sensor: macOS kernel panic due to older KEXT files present

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• macOS endpoint kernel panics
•  Kernel panic repeats 5-10 minutes after reboot

Environment

• EDR (Formerly CB Response) Sensor: 6.2.5-6.2.6
• macOS: All Supported Versions
• Newly installed sensor software

Cause

Older KEXT files from the 6.2.5 sensor are left behind after upgrading to 6.2.6

Resolution

1. Uninstall the CB Response Sensor software.
2. Remove old "KEXT" files: (zip them up and move them to another folder)

/System/Library/Extensions/CbOsxSensorNetmon.kext
/System/Library/Extensions/CbOsxSensorProcmon.kext

3. Reboot the endpoint.
4. After the reboot, re-install the newer 6.2.6 sensor.