Skip to main content
Jamf Nation, hosted by Jamf, is the largest Apple IT management community in the world. Dialog with your fellow IT professionals, gain insight about Apple device deployments, share best practices and bounce ideas off each other. Join the conversation.

CarbonBlack (6.0.4.70328) makes macOS High Sierra 10.13.2 fail

It appears that an installation of CarbonBlack (6.0.4.70328) crashes macOS High Sierra 10.13.2 and systems that are running CarbonBlack (6.0.4.70328) will not boot after an upgrade to macOS High Sierra 10.13.2.

Removing CarbonBlack appears to heal all wounds.

Like Comment
Order by:
SOLVED Posted: 12/7/17 at 1:51 PM by PeterG

Carbon Black tech support sent a message to all their customers when the 10.13.2 beta was released.

This message was sent to allow IT departments to prepare for the general release of 10.13.2.
Many companies are disabling any 'Auto Update' policies, blocking the update and removing the installers if they have already downloaded to the client computers.

[Cb Response] Important Notice Related to MacOS 10.13.2 Beta November 7, 2017 - 3:39PM Hi All, MacOS 10.13.2 Beta was released to developers yesterday. In this release, Apple has made some kernel changes that are not compatible with all versions of the Cb Response MacOS sensor. Based on internal testing, if you update to 10.13.2 Beta with the Cb Response MacOS sensor installed, you will experience a kernel panic on boot. In order to make affected machines usable again, you will need to boot into Safe Mode on each affected machine, remove the Cb Response kexts manually, and then restart. Please do not upgrade to MacOS 10.13.2 Beta on any system with Cb Response installed until we provide a sensor version that officially supports this new OS version. Please follow this post for updates and additional details. If you have any questions, please post back here or contact Cb Technical Support. Thanks, The Cb Response Team

Carbon Black released their 6.1.2-osx sensor on 11/20 and their 5.2.12-osx sensor on 12/4. These sensors have a safeguard to prevent a KP from occurring if macOS 10.13.2 is installed. Support for 10.13.2 will be provided in a upcoming maintenance release.

If you have a computer that is experiencing this problem, you will need to boot into Safe Mode on each affected machine, remove the Cb Response kexts manually, and then restart.

Like
SOLVED Posted: 12/7/17 at 4:29 PM by DakotaS96

We are having this exact problem today. Where are the kexts located? I've checked in /System/Library/Extensions and also /Library/Extensions but I don't notice anything that stands out as being related to Carbon Black.

Like
SOLVED Posted: 12/7/17 at 8:37 PM by BrandonKurtz

@DakotaS96 We did sudo rm -rf /Library/Extensions/Cb* from Safemode and that solved it.

Like
SOLVED Posted: 12/8/17 at 6:22 AM by PeterG

Thanks @BrandonKurtz for the post.

I would urge anyone experiencing the issue, or customers of Carbon Black, to participate in the Carbon Black User Exchange. The specific thread on this, which I quoted above) it this one. You need to register to see some of the documents.

Also, you can contact Contact Carbon Black technical support for additional assistance.

Like
SOLVED Posted: 12/8/17 at 2:24 PM by cwaldrip

My office hasn't deployed CB yet as we continue to see random kernel panics on pre-10.13 machines. We can't afford to have an edit machine go down with a kernel panic which rushing to edit video for broadcast. Luckily we're working closely with the developers, but progress is slow. Nice to know we can do their debugging for them.

Hey Bob, let's make our security software a kernel extension. It'll catch more bad guys that way. But Phil, if there's even a slight bug in our app it'll crash the entire computer! Don't worry about that Bob, it's a feature. If they can't use the computer it can't be infected by bad guys!
Like
SOLVED Posted: 12/12/17 at 4:13 PM by ekkehard

Best way to fix this is to uninstall CarbonBlack by booting into the recovery partion chroot to the startup volume and run the CarbonBlack uninstall script:

chroot /Volumes/[BootVolumeName] sh /Applications/CarbonBlack/sensoruninst.sh

Note: CarbonBlack (6.1.2.71112) fixes the kernel panic issue but will basically turn of CarbonBlack for macOS High Sierra 10.13.2 machines.

Like