There are many, many possibilities for what could have happened which need to be investigated. Some of which would be surprisingly hard to test for.
1. Did the CDN have a failing disk? A full null read sometimes happens with failing drives.
2. Did the disk holding the update fail just before the CDN upload? (I.e. did the deployment script successfully upload a failed read?)
3. Did the CDN upload fail, but a different process thought it succeeded, activating distribution?
4. Did their updates conform to an internal standard which is later serialized or minified for public distribution, and something broke in the serializer or compression tool?
It is completely possible that the update was tested, good to go, and there was a distribution failure.
However, I do know what Cloudstrike could have done, and should do in the future:
- Staged rollouts, even 15 minutes would help as a gap
- More testing (duh)
- Perhaps most importantly, improving the kernel driver to never crash from any possible input using a fuzzer, but continue booting and warn userspace of failure