| VMware Carbon Black Cloud 2.14.0 | 23 JAN 2023 | Build 2.14.0 Check for additions and updates to these release notes. |
What's New
-
Product Features
Graviton Support
CBC Linux sensor now offers support for the Graviton (aarch64) chipset. Graviton support is offered on the eBPF OS distributions with glibc version of 2.28 or higher. Please refer to the OER page for more information on the OS distributions that are supported for Graviton.
The Linux sensor will now be able to run on AWS EC2 instances with the Graviton processor. All existing sensor functionalities will retain and continue to be supported with this sensor release.
OS Distribution Updates
Support for the following minor OS updates are also included as part of this release:
-
Debian 11.4, Debian 11.5, Debian 11.6
-
Debian 10.13
-
Open Suse 15.4
-
Oracle 9
-
Oracle 8.7
-
RHEL 9.1
-
RHEL 8.7
-
Suse 15 SP 4
-
Ubuntu 22.10
-
-
Purpose of this release
The 2.14.0 Carbon Black Cloud Linux Sensor is considered a minor release introducing Graviton processors support. OS distribution support for OS updates is also included as part of the 2.14.0 sensor release.
Resolved Issues
This section lists defects that have been resolved in the 2.14.0 Carbon Black Cloud Linux Sensor.
-
PSCLNX-11285: Fixed an issue where the ThMgr could not connect to the event collector
-
PSCLNX-11322: Fixed an issue where the event message queue engine could crash on sensor startup
-
PSCLNX-10803: Fixed a connection issue with the Live Response session
The live response session was unable to connect back to the backend for 15 minutes after disconnecting the initial session.
-
PSCLNX-10984: Fixed the sensor behavior of events being dropped on EC2 instances
With these changes, the sensor now only opens the regular processing files instead of system specific files. This addresses the issue of events being dropped.
-
EA-21500: Fixed an issue where the effective reputation field displays two dashes (--), instead of a valid reputation text
Associated with PSCLNX-10835.
-
EA-21961: Fixed an issue with VDI VM re-registration when the first IC desktop pool is created
Associated with PSCLNX-10305.
-
EA-22047: Fixed a deadlock that could cause the sensor to stop responding to configuration and policy changes
Associated with PSCLNX-11199.
-
EA-21505: Fixed an issue that was causing high memory usage for cbagentd and event_collector
These changes have improved memory allocation by approximately 1GB.
Associated with EA-21326, PSCLNX-10984.
Known Issues
The following table lists the known issues and limitations present in the Carbon Black Cloud 2.14.0 Linux Sensor.
-
PSCLNX-10216: The cbagentd service fails to stop
Upgrading from sensor versions 2.7.1 and older might fail in some situations because the cbagentd service fails to stop. Customers experiencing this issue need to uninstall the sensor and reinstall the latest version.
-
PSCLNX-11089: Failed to terminate error
Execution of a banned script results in "Failed to terminate" error message in the threat hunter logs, and generates duplicate alerts.
-
PSCLNX-10980: Banned binaries
On kernel module distros, banned binaries are not allowed to execute even after the sensor shutdown. Expected behavior is for the sensor to allow the blocked binary after sensor shutdown.
