Cloudflare Fixes Flaw That Let One Container Read Another Customer's Leftover Disk Data
Cloudflare fixed a Containers flaw that exposed other customers' leftover disk data.
Cloudflare and researchers said a flaw in Cloudflare Containers, which also underlies Cloudflare Sandboxes, let a customer read data previous containers left on shared disks. Thin-provisioned 64 KB blocks were returned to a cross-account pool without wiping, so a 4 KB write still exposed the rest of a prior tenant's block. Production tests recovered leftovers on 18 of 24 attempts, including directory listings, SQLite databases, Chromium profiles, .env files, and credential files. Oren Yomtov of Accomplish reported it on September 4; Cloudflare restored wiping, cleared existing disks by September 19, and said retained logs showed only authorized testing.
- Reused 64 KB thin-provisioned blocks were handed out without wiping.
- Leftover data was recovered on 18 of 24 production attempts.
- Recovered material included SQLite databases, .env files, and credentials.
- Cloudflare restored wiping and finished disk cleanup on September 19.
- Retained logs showed only authorized researcher and Cloudflare testing.
- Vendors
- Cloudflare
- Organizations
- CloudflareAccomplish
From the original article
3 min read at thehackernews.com
A flaw in Cloudflare Containers let a paying customer read data that other customers' containers had left behind on the same server, Cloudflare and the researchers who found it said on Thursday. The data came from disk space that earlier containers had used and given up, not from any live workload, and an attacker could not choose whose data they got, according to Cloudflare. The company
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.