App Control: Endpoints Crash Due to the Ransomware Rapid Config

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Endpoints crashing when the Ransomware Rapid Config is enabled. 

Environment

• App Control Agent: 8.0.0.2146 (Patch 3) - 8.0.0.2562 (Patch 6) (Formerly CB Protection)

Cause

This is caused by an issue with the agent scanning the a write buffer due to the Ransomware Rapid Config enabled.

Resolution

• This was corrected with a code change that was rolled out in version 8.0.0.2621 and later. We used EP-4547 to track this internally.
• If for some reason you're unable to upgrade we recommend disabling the Ransomware Rapid Config temporarily until the upgrade takes place.