CLOUDFLARE FIXES CONTAINERS CROSS-TENANT FLAW EXPOSING CUSTOMER DATA

Summary from the TLDR InfoSec newsletter

Cloudflare remediated a cross-tenant flaw in Containers and Sandboxes that allowed a Workers Paid customer to read residual disk blocks left by other tenants on the same host. The flaw stemmed from dm-thin storage pools running with skip_block_zeroing, so a 4 KiB write into a reused 64 KiB block left the untouched 60 KiB readable via a raw read of /dev/vdc. Accomplish's Oren Yomtov, who reported it through HackerOne on September 4, recovered directory structures, database pages, and complete SQLite databases on 18 of 24 placements across 20 of 22 nodes, though an attacker could not target a specific victim or read an actively attached disk. Cloudflare removed skip_block_zeroing fleet-wide, retired running container disks, and cleared cached image snapshots by September 19. Its disk-I/O telemetry review found no exploitation beyond authorized validation, so no customer action is required.