# Sehemu moja ya ziada ilisababisha kompyuta milioni 8.5 kuacha kufanya kazi. Dakika 78.

Published: 2026-09-14

Julai 19, 2024, 04:09 UTC: CrowdStrike inasukuma Channel File 291 — sasisho la Maudhui ya Majibu ya Haraka — kwa kila sensa ya Windows Falcon iliyo mtandaoni. Template iliyolisha ilitangazwa ikiwa na sehemu 21 za kuingiza data mwezi Februari; nambari inayotoa data ya kuingiza inajenga safu ya 20. Kwa miezi minne hakuna kinachosoma sehemu ya 21, kwa sababu kila sheria inaiacha kama wildcard. Sasisho hili linaweka mfumo halisi hapo. Kidhibiti cha Maudhui cha upande wa wingu kinahesabu 21 dhidi ya tamko na kuipitisha; Mtfsiri wa Maudhui wa sensa, bila ukaguzi wa mipaka, anasoma nafasi ya 21 katika kernel mode na Windows page-faults: PAGE\_FAULT\_IN\_NONPAGED\_AREA, csagent.sys. Dereva inapakia mapema wakati wa kuanza kwa makusudi, inasoma faili hiyo hiyo, inaanguka tena — boot loop. Imerejeshwa saa 05:27 UTC, dakika 78 baadaye, lakini mashine milioni 8.5 (hesabu ya Microsoft, chini ya 1% ya Windows) tayari zina faili hiyo, na suluhisho ni binadamu kwenye kila kibodi: Safe Mode, futa C-00000291\*.sys, ufunguo wa kurejesha wa BitLocker. Mashirika ya ndege, hospitali, benki na vituo vya 911 vinaacha kufanya kazi; Delta inafuta takriban safari 7,000 za ndege na kudai angalau dola milioni 500 kutoka CrowdStrike na Microsoft; Parametrix inaweka bili ya Fortune 500 karibu dola bilioni 5.4. Postmortem kutoka kwa Uchambuzi wa Mizizi ya CrowdStrike yenyewe, Mapitio ya Awali Baada ya Tukio, blogi ya Microsoft, 8-K ya Delta na ushuhuda wa Bunge. Git blame: 65 CrowdStrike / 25 muundo wa kernel-mode / 10 Ijumaa. Hukumu juu ya suluhisho: SHIP IT, kwa shida.

Canonical: https://thedailydiff.dev/sw/video/2026-09-14-crowdstrike-21-fields/

## Nini video hii inashughulikia

- Feb 28 – Apr 24, 2024: sensa 7.11 inatuma Aina ya Template ya IPC (sehemu 21 zimetangazwa, 20 zimetolewa); mtihani wa shinikizo unapita Machi 5; visa vinne vinafanya kazi kwa sababu sehemu ya 21 ni wildcard
- Jul 19, 04:09 UTC: Matukio mawili mapya ya Template; kosa la kimantiki la Kidhibiti cha Maudhui linaruhusu ile isiyo ya wildcard kupita; usomaji nje ya mipaka katika kernel; 05:27 UTC imerejeshwa
- Jul 19–29: urekebishaji wa mikono (Safe Mode, futa faili, ufunguo wa BitLocker); ~97% ya sensa zimerudi kufanya kazi kufikia Jul 24, ~99% kufikia Jul 29
- Jul 25 – Agosti 19: ukaguzi wa mipaka wakati wa utekelezaji, uhakiki wa hesabu ya sehemu wakati wa kuunda, ukaguzi wa Kidhibiti, canary + pete za usambazaji, udhibiti wa mteja juu ya Maudhui ya Majibu ya Haraka, ukaguzi huru mbili; RCA kamili na dampu ya kuanguka mnamo Agosti 6

## Nakala iliyotafsiriwa

Imetafsiriwa kutoka simulizi asili ya Kiingereza. Sauti na manukuu yanayopatikana yanadhibitiwa na YouTube.

0:00 Sasisho moja la usalama hubeba sehemu ishirini na moja kwenye dereva iliyoundwa kwa ajili ya ishirini, na mashine milioni nane na nusu za Windows zinapata blue-screen kabla ya kifungua kinywa. Julai 19, 2024, 04:09 UTC. CrowdStrike inasukuma Channel File 291 kwa kila sensa ya Falcon. Dakika sabini na nane baadaye wanaiondoa; kufikia wakati huo mashirika ya ndege, hospitali na benki zinatazama mstatili huo wa buluu. Ujumbe wa kwanza wa Mkurugenzi Mtendaji unasema si shambulio la mtandaoni, kweli, na si hoja. Inatokeaje, kwa nini inawezekana, na nani anapata lawama.

0:27 Huu ni The Daily Diff, postmortem. Februari 28. Sensor 7.11 inatoa kitambuzi kipya kwa mabomba yenye majina. Inatangaza sehemu ishirini na moja za kuingiza data; nambari inayolisha inajenga safu ya ishirini. Hakuna anayegundua: kwa miezi minne kila sheria inaiacha sehemu ya ishirini na moja kama wildcard, na hakuna anayesoma wildcard. Mtihani wa shinikizo unapita, sheria nne zinatolewa, zote sawa. Julai 19, 04:09. Sheria mbili mpya; moja inaweka mfumo halisi katika sehemu ya ishirini na moja.

0:51 Kidhibiti cha wingu kinahesabu ishirini na moja dhidi ya tamko na kusema sawa. Kila mwenyeji wa Windows aliye mtandaoni anaipakua mara moja, kwa sababu hakuna pete ya canary. Sensa inasoma nafasi ya ishirini na moja, ambayo si kumbukumbu yake, na kernel inafanya kile ambacho kernel hufanya. 05:27, imerejeshwa. Imechelewa kwa yeyote aliyewasha tena: dereva inapakia mapema katika boot, inasoma faili hiyo hiyo, na inaanguka tena. Boot loop. Kwa nini hii inawezekana? Sheria ni usanidi uliosukumwa kutoka wingu, kwa hivyo hakuna nambari inaruka nambari

1:16 bomba. Mkalimani hana ukaguzi wa mipaka; anaamini mdhibiti, na mdhibiti anaamini tamko. Na yote yanaendeshwa katika kernel mode, ambapo pointer mbaya sio ubaguzi bali kosa la ukurasa Windows inasema haliwezi kulindwa na jaribu-isipokuwa. Patrick Wardle anaisoma kutoka dampu ya kuanguka alasiri hiyo: index sifuri x kumi na nne, nafasi ya ishirini na moja. Marekebisho ni ya mikono. Safe Mode, futa C-00000291, washa tena. Na BitLocker, kwanza andika nambari arobaini na nane za

1:43 ufunguo wa kurejesha unaoishi kwenye server ambayo pia ni bluu. git blame. CrowdStrike, asilimia sitini na tano: RCA inaorodhesha matokeo sita, na matokeo ya sita ni sentensi kamili: Matukio ya Template yanapaswa kuwa na hatua za usambazaji. Muundo wa kernel-mode, ishirini na tano: CrowdStrike inasema Windows haiwezi bado kuweka usalama nje ya kernel, Microsoft inasema sio tukio la Microsoft, na kosa la ukurasa halijali.

2:05 Ijumaa, kumi. Ujumbe wa kuahidi unasema sio msimbo. Kiwango cha mlipuko: vifaa milioni nane na nusu, chini ya asilimia moja ya Windows. Delta inafuta safari elfu saba na kumshtaki kwa milioni mia tano, Microsoft imejumuishwa. Makampuni ya bima yanaweka bili ya Fortune 500 karibu na bilioni tano. Hacker News: alama elfu nne na mia tano. Dhihaka: sasisho lililokusudiwa kugundua mbinu mpya za mashambulizi lilileta moja. Hukumu, postmortem: SHIP IT, kwa shida.

2:27 Ukaguzi wa mipaka katika siku sita, pete za hatua, udhibiti wa mteja juu ya sasisho za maudhui, ukaguzi wawili wa nje. Kwa shida, kwa sababu yote hayo yalikuwa mazoea ya kawaida tayari. Jumatatu: chochote wakala wako anachovuta kutoka wingu kinapata pete ya canary. Usanidi ni msimbo wakati kitu kinapochanganua mahali ambapo hakiwezi kutupa. Nitumie tukio ambalo bado hauruhusiwi kulizungumzia, kwenye maoni, au kwa the daily diff dot dev. Na hiyo ndio diff ya leo.

2:48 Mimi ni Niko kutoka Axrisi. Unganisha kwa uwajibikaji.

## Vyanzo

- [CrowdStrike, Root Cause Analysis — Channel File 291 (Aug 6, 2024, 12 pp.)](https://www.crowdstrike.com/wp-content/uploads/2024/08/Channel-File-291-Incident-Root-Cause-Analysis-08.06.2024.pdf) — www.crowdstrike.com
- [CrowdStrike, Executive Summary of the RCA (Aug 6, 2024)](https://www.crowdstrike.com/wp-content/uploads/2024/08/Executive-Summary_Root-Cause-Analysis_Channel-File-291.pdf) — www.crowdstrike.com
- [CrowdStrike, Preliminary Post Incident Review (Jul 24, 2024)](https://www.crowdstrike.com/en-us/blog/falcon-content-update-preliminary-post-incident-report/) — www.crowdstrike.com
- [CrowdStrike, Remediation and Guidance Hub — Channel File 291 (the workaround steps)](https://www.crowdstrike.com/falcon-content-update-remediation-and-guidance-hub/) — www.crowdstrike.com
- [CrowdStrike, tech alert of Jul 19, 2024 (archived: Safe Mode → delete C-00000291\*.sys → BitLocker key)](https://web.archive.org/web/20240719145915/https://www.crowdstrike.com/blog/statement-on-falcon-content-update-for-windows-hosts/) — web.archive.org
- [Microsoft, David Weston, "Helping our customers through the CrowdStrike outage" (Jul 20, 2024; the 8.5 million figure)](https://blogs.microsoft.com/blog/2024/07/20/helping-our-customers-through-the-crowdstrike-outage/) — blogs.microsoft.com
- [Delta Air Lines, Form 8-K (Aug 8, 2024; ~7,000 cancellations, at least $500 million)](https://www.sec.gov/Archives/edgar/data/27904/000168316824005369/delta_8k.htm) — www.sec.gov
- [Adam Meyers (CrowdStrike SVP), written testimony, House Homeland Security Subcommittee (Sep 24, 2024)](https://homeland.house.gov/wp-content/uploads/2024/09/2024-09-24-HRG-CIP-Testimony-Meyers.pdf) — homeland.house.gov
- [George Kurtz on X, Jul 19, 2024, 09:45 UTC](https://x.com/George_Kurtz/status/1814235001745027317) — x.com
- [Patrick Wardle on X, Jul 19, 2024 (the crash-dump index 0x14)](https://x.com/patrickwardle/status/1814343502886477857) — x.com
- [Hacker News, Jul 19, 2024 — "CrowdStrike Update: Windows Bluescreen and Boot Loops" (4,489 points)](https://news.ycombinator.com/item?id=41002195) — news.ycombinator.com
- [The Guardian, Jul 24, 2024 — "CrowdStrike global outage to cost US Fortune 500 companies $5.4bn" (Parametrix estimate)](https://www.theguardian.com/technology/article/2024/jul/24/crowdstrike-outage-companies-cost) — www.theguardian.com
- [Hacker News, Jul 21, 2024 — "Initial details about why CrowdStrike's CSAgent.sys crashed" (519 points)](https://news.ycombinator.com/item?id=41021366) — news.ycombinator.com
- [Wikipedia — 2024 CrowdStrike-related IT outages](https://en.wikipedia.org/wiki/2024_CrowdStrike-related_IT_outages) — en.wikipedia.org