Cloudflare fixes cross-tenant data exposure flaw in Containers and Sandboxes

Cloudflare has remediated a vulnerability in Containers and Sandboxes that could expose residual data from one customer's workload to another customer sharing the same physical host. The company says it found no evidence that the technique was used maliciously or that customer data was compromised.

Security researcher Oren Yomtov of Accomplish reported the issue through Cloudflare's bug bounty program on September 4. Cloudflare's disclosure says the affected services run customer workloads on multi-tenant infrastructure, with placement handled automatically rather than chosen by customers.

Reused blocks were not fully cleared

The flaw was in a shared storage pool configured to skip zeroing reused 64 KiB blocks. A researcher could write 4 KiB into an unused region of a new container's disk and cause the system to allocate a block that had previously belonged to another container. The new write replaced only 4 KiB, potentially leaving the remaining 60 KiB readable.

BleepingComputer reports that controlled tests recovered directory listings, SQLite database pages, Chromium profiles, environment files and credential files. The technique could not select a particular victim or host, read an actively attached disk, modify another customer's data or disrupt another workload.