Attackers could not exploit the flaw to allow arbitrary memory address write or program execution even if they could manipulate kernel memory, said CrowdStrike Vice President Adam Meyers.
Aside from inconsistencies between Content Validator inputs and those received by the Content Interpreter, such an issue was also caused by an out-of-bounds flaw in the Content Interpreter and inadequate testing, according to a root cause analysis issued by CrowdStrike.
Such a security issue — which is a patch bypass for the already addressed path traversal flaw, tracked as CVE-2024-36104 — stems from an authentication mechanism vulnerability enabling unauthenticated access to critical endpoints.
"Delta's public threat of litigation distracts from this work and has contributed to a misleading narrative that CrowdStrike is responsible for Delta's IT decisions and response other than the outage," said CrowdStrike attorney Michael Carlinsky to Delta lawyer David Boies.
While North America and Latin America were noted by Microsoft to be most severely impacted by the outage, which was attributed to a "configuration change," UK customers also reported experiencing Azure service errors.
Intrusions leveraging the flaw against impacted modules on the 1756 chassis containing the devices' communication processors, controllers, and I/O modules could result in the execution of common industrial protocol commands enabling the alteration of controller user projects and/or device configurations.
Despite repeatedly proclaiming the robustness of Falcon, CrowdStrike has not properly evaluated anti-threat updates prior to release leading to the widespread disruption, claimed the Massachusetts-based Plymouth County Retirement Association in its lawsuit.
Fast Five
Selected by the SC Media Editorial team every Tuesday.
Sign up now for the top five issues cybersecurity pros need to know this week.
