EDR Sensor: macOS kernel panic due to older KEXT files present
search cancel

EDR Sensor: macOS kernel panic due to older KEXT files present

book

Article ID: 288050

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

  • macOS endpoint kernel panics
  • ┬áKernel panic repeats 5-10 minutes after reboot

Environment

  • EDR (Formerly CB Response) Sensor: 6.2.5-6.2.6
  • macOS: All Supported Versions
  • Newly installed sensor software

Cause

Older KEXT files from the 6.2.5 sensor are left behind after upgrading to 6.2.6

Resolution

  1. Uninstall the CB Response Sensor software.
  2. Remove old "KEXT" files: (zip them up and move them to another folder)
/System/Library/Extensions/CbOsxSensorNetmon.kext
/System/Library/Extensions/CbOsxSensorProcmon.kext
  1. Reboot the endpoint.
  2. After the reboot, re-install the newer 6.2.6 sensor.