Cloudflare Workers Spectre Attack Leaks JWT From Co-Located Worker at 12 Bits/Second

Summary: Researchers disclosed a remote Spectre attack against Cloudflare Workers that leaked a JSON Web Token from a co-located Worker in the production environment at up to 12 bits per second at 99.16% accuracy, compared with 2 bits per minute in a 2021 attack. The paper said no customer data was accessed, and Cloudflare said the attack has been mitigated in production after it improved Dynamic Process Isolation, integrated the V8 Sandbox, and deployed Memory Protection Keys-based in-process isolation, finding no indicators of active exploitation over the last three years.
Why it matters: The researchers showed Cloudflare's production DyPrIs was insufficient: WebSocket I/O activity pushed the branch-misprediction signal below its detection threshold, and a long-lived Durable Object invocation could keep running for five to more than 20 hours before isolation took effect. Cloudflare Workers relies on language-level V8 isolate isolation rather than strict process isolation, so a memory read within a shared Worker process can become cross-tenant leakage.

Read the original at The Hacker News ↗