Cloudflare Workers Spectre Attack Leaks JWT From Co-Located Worker at 12 Bits/Second
Researchers demonstrated a remote Spectre attack against Cloudflare Workers that leaked a JWT from a co-located Worker at up to 12 bits per second, a 360x improvement over a 2021 attack that achieved only 2 bits per minute The attack exploited two weaknesses in Cloudflare's Dynamic Process Isolation (DyPrIs): long-lived Durable Object invocations could continue running before isolation took effect, and WebSocket-heavy I/O activity suppressed the branch-misprediction detection signal below its th
Analysis
TL;DR
- Researchers demonstrated a remote Spectre attack against Cloudflare Workers that leaked a JWT from a co-located Worker at up to 12 bits per second, a 360x improvement over a 2021 attack that achieved only 2 bits per minute
- The attack exploited two weaknesses in Cloudflare's Dynamic Process Isolation (DyPrIs): long-lived Durable Object invocations could continue running before isolation took effect, and WebSocket-heavy I/O activity suppressed the branch-misprediction detection signal below its threshold
- Cloudflare has already mitigated the vulnerability in production by improving DyPrIs, integrating the V8 Sandbox to limit transient access to 64-bit pointers, and deploying Memory Protection Keys (MPK)-based in-process isolation with a rotating memory layout
- The attack was conducted on AMD EPYC Zen 2 and Zen 3 processors at night (10-25% CPU utilization) achieving 99.16% accuracy, with higher system load reducing but not eliminating the leakage rate
- Cloudflare found no indicators of active exploitation over the past three years and confirmed no customer data was accessed during the research
Why It Matters
This research highlights the ongoing cat-and-mouse game between side-channel attack techniques and cloud isolation mechanisms, demonstrating that even mature defenses like DyPrIs can have fundamental limitations when confronted with refined attack methodologies. For AI practitioners and cloud security professionals, it underscores the importance of defense-in-depth strategies and hardware-assisted isolation when running multi-tenant workloads, as software-level protections alone may not suffice against sophisticated Spectre-class attacks.
Technical Details
- Attack Mechanism: A remote Spectre v1-style attack leveraging branch misprediction to leak memory from a co-located Worker isolate within the same OS process. The attacker used WebSocket communications as a remote timing source and Durable Objects to maintain isolate liveness for 5-20+ hours, bypassing DyPrIs process isolation delays.
- DyPrIs Weaknesses: The existing Dynamic Process Isolation mechanism isolates suspicious scripts into separate processes only after invocation completion. Long-lived Durable Object invocations outlasted this window, and WebSocket-heavy I/O increased iTLB activity, reducing the normalized branch-misprediction signal below DyPrIs detection thresholds.
- Mitigations Deployed: (1) Improved DyPrIs with enhanced detection capabilities, (2) V8 Sandbox limiting transient access to 64-bit pointers, (3) MPK-based in-process isolation placing Worker heaps behind hardware-enforced protection keys combined with a rotating memory layout to prevent key collision between neighboring sandboxes, achieving near-100% trap rate for cross-isolate accesses.
- Experimental Setup: Production Linux servers with AMD EPYC Zen 2 and Zen 3 processors, measurements conducted at night during low CPU utilization (10-25%), achieving 12 bits/second leakage at 99.16% accuracy compared to the 2021 baseline of 120 bits/hour.
Industry Insight
- Cloud providers running multi-tenant serverless workloads should prioritize hardware-assisted isolation mechanisms (like MPK) over purely software-based detection, as side-channel attacks will continue to evolve around timing and signal-suppression techniques
- The 360x improvement in attack speed over five years demonstrates that Spectre-class vulnerabilities require continuous investment in both detection and mitigation; organizations should treat isolation guarantees as iterative rather than one-time implementations
- The finding that I/O activity can suppress detection signals suggests that workload characterization and behavioral monitoring should be integrated into isolation frameworks, particularly for applications with heavy WebSocket or network I/O patterns
Disclaimer: The above content is generated by AI and is for reference only.