Cybersecurity researchers have revealed a significant vulnerability in Cloudflare Workers, detailing a remote Spectre attack that can leak a JSON Web Token (JWT) from a co-located Worker at a rate of up to 12 bits per second. This rate is 360 times faster than a similar attack demonstrated in 2021, according to reporting by The Hacker News.
The researchers conducted an end-to-end experiment using an attacker Worker and a victim Worker, with the JWT intentionally placed in the victim’s memory. They confirmed that no customer data was accessed during the experiment.
In response to the vulnerability, Cloudflare stated that it has already implemented mitigations in production. These include enhancements to Dynamic Process Isolation (DyPrIs), integration of the V8 Sandbox, and deployment of Memory Protection Keys (MPK)-based in-process isolation. The company reported no indicators of active exploitation over the past three years.
The research highlighted that the production implementation of DyPrIs was insufficient, as it relies on language-level isolation rather than strict process isolation to reduce startup latency. This can lead to cross-tenant leakage if a memory read occurs within a shared Worker process.
Cloudflare noted that while it restricts local timing sources and does not expose shared memory or multithreading to Worker scripts, the researchers found that WebSocket communications could provide a remote timing source. Additionally, Durable Objects could keep a single Worker isolate alive for extended periods, complicating isolation efforts.
The researchers conducted their tests on Linux servers using AMD EPYC Zen 2 and Zen 3 processors, intentionally running measurements during low CPU utilization periods to achieve optimal results. They reported a leakage rate of up to 12 bits per second with 99.16% accuracy, a significant improvement over the previous attack’s rate of 2 bits per minute.
This disclosure comes nearly five years after Cloudflare and TU Graz published research demonstrating a remote Spectre attack against Workers, which operated at a rate of 120 bits per hour and introduced DyPrIs as a defense mechanism. Cloudflare has since published additional hardening measures for its Workers platform, aimed at enhancing security against such vulnerabilities.
- Improved DyPrIs: Enhances detection capabilities of the existing isolation mechanism.
- V8 Sandbox: Limits transient access to 64-bit pointers.
- MPK-based in-process isolation: Places Worker heaps behind hardware-enforced protection keys.
Follow Cyber Warriors Middle East for further global cybersecurity developments.
