A vulnerability in Cloudflare’s Containers infrastructure could have exposed residual data from one customer’s workload to another customer running on the same physical host. Cloudflare says it has now fully remediated the issue, including the related impact on its Sandboxes service.
The issue also affected Cloudflare Sandboxes, which is built on the same infrastructure. Cloudflare says the vulnerability has been fully remediated, requires no customer-side changes, and showed no evidence of malicious exploitation in the historical telemetry available to the company.
How the data exposure could happen
The problem was tied to how Cloudflare reused storage blocks for container disks. Its infrastructure used Linux device mapper thin provisioning, or dm-thin, to allocate physical storage as workloads needed it. An affected setting called skip_block_zeroing prevented newly assigned blocks from being cleared before reuse.
That meant a block previously used by one container could be reassigned to another while still retaining some of its old contents. If the new workload overwrote only part of the block, data left in the remaining portion could potentially be read.
Cloudflare said the exposed material could include filesystem metadata, directory structures, database pages, and application data. The flaw crossed the isolation boundary between customers, but it did not let an attacker select a specific victim, access another customer’s actively attached disk, or modify active data. Whether anything could be recovered depended on how workloads were placed and which previously used storage blocks were reassigned.
Cloudflare changed how reused storage is handled
To address the issue, Cloudflare removed the setting that disabled block clearing, restoring dm-thin’s default behavior of zeroing newly allocated storage before exposing it to a container.
That change did not clear data already present in existing mappings, so Cloudflare also replaced running container disks and removed cached image snapshots created before the mitigation. The company says the cleanup has been completed across the Containers fleet.
Cloudflare also reviewed retained disk-I/O telemetry for patterns matching the technique used to demonstrate the flaw. It said the only matching activity came from authorized testing by the researchers and Cloudflare engineers, with no additional activity suggesting malicious exploitation.
Cloudflare says the affected storage behavior has now been removed across its Containers fleet and that older mappings created before the fix have been cleared. Customers do not need to make any changes on their side.
Leave a Reply