Resolved issues

ENDPT-92700

Event Log collections were missing information for Endpoints running on Windows. Audits running on Windows now expand Event Log variables. This feature facilitates parsing of the complete Event Log.

ENDPT-106018

The network filtering system in the fekern.sys driver removes network filters and unregisters the filter from new and existing network connections when the agent is shut down in a Windows environment. New network connections created during shutdown are frequently associated with an existing filter structure creating performance issues within the Windows environment. This resulted in several xAgent processes being started and not used.

ENDPT-110198

xagtnotif.exe consumes excessive RAM when the xAgent is stopped. This prevented the clearing of buffered log lines from the logging cache. The logging cache has since been configured to log only when the xAgent service and other critical failures have failed.

ENDPT-110538

A third-party component depends on the net/http module and collects events for agents running on a Linux environment. A vulnerability scanner reported that the net/http module was affected by CVE-2022-27664. The third-party component and the agent are unaffected by this CVE. The version of Golang used to build this module was updated to 1.20.4, updating dependent packages.

ENDPT-111972

A cache for tracking file changes was added to the Windows driver in agent version 35.31.22. The cache was initialized incorrectly which seldomly caused adjacent data to be overwritten leading to bug checks in the system. This issue occurs during the initialization of the driver and is unavoidable.

ENDPT-112769

An issue with the Windows 11 23H2 and Windows Server 2022 operating systems prevented the xAgent from calculating the start offset of physical memory on the system. This issue caused the full, process, and driver memory acquisitions to fail.

ENDPT-112195

The vulnerability within CVE-2023-2650 caused performance issues with OpenSSL, an agent dependency. OpenSSL will be upgraded to version 3.0.10 to address CVE-2023-2650. The xAgent now uses OpenSSL version 3.1.2.

ENDPT-112347

Audits on Windows 8 and later now utilize the correct CPU limit APIs to prevent acquisition failure. This fixed an issue where the Windows Library Loader Lock system failed to complete audits.

ENDPT-112517

AppUIMonitor processes failed to close for Citrix users when they logged off. Exploit Guard's AppUIMonitor process now terminates correctly when users log off in Citrix environments.

ENDPT-112663

An issue with the SNI header prevented the xAgent from communicating with the HX Cloud via proxies. xAgent communication now includes the fully qualified domain name in the SNI header. This allows communication to HX Cloud when a proxy is configured.