EDR: The System Detected an Overrun of a Stack-Based Buffer in this Application

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application

Environment

• EDR Sensor: 7.1.1
• Microsoft Windows: All Supported Versions

Cause

Sensor attempt to remove a process that has already been removed from a table in memory

Resolution

• This issue is resolved in EDR Sensor version  7.2.1
• Tracking reference CB-34300