CB Protection: Intermittent BSOD Caused By Outdated System Drivers

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Machine with CB Protection Agent installed will intermittently generate a BSOD
• Stack trace and Bugcheck Analysis from memory dump contain following lines:

STACK_TEXT: 
ffffd801`25287a88 fffff806`a74aaf32 : 00000000`0000014f 00000000`00000004 00000000`00000001 ffffdc81`b8ebc8e0 : nt!KeBugCheckEx 
ffffd801`25287a90 fffff802`52a60315 : ffff9c00`d01d6700 ffff9c00`b92aa920 fffff802`52f8ac00 ffff9c00`b92aa920 : pdc!PdcpNotificationWatchdog+0x182 
ffffd801`25287b00 fffff802`52b02cb7 : ffff9c00`d01d6700 00000000`00000080 ffff9c00`b92fc440 ffff9c00`d01d6700 : nt!ExpWorkerThread+0xf5 
ffffd801`25287b90 fffff802`52bbd7d6 : ffffb181`ce980180 ffff9c00`d01d6700 fffff802`52b02c70 00000000`00000000 : nt!PspSystemThreadStartup+0x47 
ffffd801`25287be0 00000000`00000000 : ffffd801`25288000 ffffd801`25281000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16

***************** 
Bugcheck Analysis 
***************** 
PDC_WATCHDOG_TIMEOUT (14f) 
A system component failed to respond within the allocated time period, 
preventing the system from exiting connected standby. 
Arguments: 
Arg1: 0000000000000004, Client ID of the hung component. 
Arg2: 0000000000000001, A notification client failed to respond. 
Arg3: ffffdc81b8ebc8e0, Pointer to the notification client (pdc!_PDC_NOTIFICATION_CLIENT). 
Arg4: ffffd80125287ae0, Pointer to a pdc!PDC_14F_TRIAGE structure. 

Environment

• CB Protection Agent: Version 8.0.0.2621 (Patch 7)
• Microsoft Windows 10

Cause

Endpoint has an outdated OS patch version

Resolution

Updating system drivers will resolve issue.


 

Additional Information

• Issue is not related to CB Protection Agent