A vulnerability in Cloudflare’s container infrastructure allowed unauthorized access to residual data from other customers’ containers on shared servers. This issue, identified by researchers and confirmed by Cloudflare on Thursday, has been rectified to prevent further unauthorized data access.
Details of the Flaw
The flaw involved leftover data from previously used disk space, not from active workloads, as clarified by Cloudflare. Attackers couldn’t choose whose data was accessed. Cloudflare swiftly addressed this flaw, ensuring that customers need no further action.
Cloudflare Containers, which host customer applications on shared servers, was affected. This includes Cloudflare Sandboxes, marketed as a secure environment for executing untrusted code, including AI-generated scripts.
Discovery and Reporting
The vulnerability was reported to Cloudflare on September 4 by Oren Yomtov from Accomplish, a security firm, through their bug bounty program. The issue originated from improper disk management using a Linux feature known as thin provisioning, which allocates storage in 64-kilobyte increments.
When containers were deleted, their storage blocks returned to a shared pool without being wiped, allowing subsequent containers to access leftover data. The researchers demonstrated this by writing a small block and reading back the entire block, revealing data from previous containers.
Resolution and Security Measures
Cloudflare’s remediation involved re-enabling the wiping function for newly allocated blocks, effectively stopping the data exposure method. Researchers confirmed on September 14 that their method was ineffective post-update.
Further action included retiring all running container disks and clearing server caches to eliminate any residual data exposure risks. This comprehensive cleanup was completed by September 19, followed by public disclosure of the issue.
Cloudflare investigated potential misuse of this vulnerability by others but found no evidence beyond authorized testing by the researchers and its engineering team. The duration of the exposure remains unspecified due to incomplete historical records.
Implications and Future Outlook
The researchers noted that similar disk management issues affected Cloudflare’s Browser Run product. This flaw is their sixth sandbox escape since July, following vulnerabilities found in various other platforms like OpenAI’s Codex and Docker.
Cloudflare’s prompt response underscores the importance of robust security practices and continuous monitoring in cloud environments. The steps taken to secure customer data highlight the company’s commitment to maintaining a trustworthy service.
