Latest / The Digital Warfare Podcast / EP. 168: Cloudflare Container Flaw Exposed Data Across Customer Environments
Transcript
- Digital Warfare: You're listening to the Digital Warfare Podcast. Today, we're looking at a cloud vulnerability that demonstrates why tenant isolation is one of the most important security boundaries in modern cloud computing. The issue affected Cloudflare containers and sandboxes. And the vulnerability could potentially allow one customer to recover residual data left behind by another customer's container running on the same underlying physical infrastructure. Here's what happened. Cloud container platforms are built around isolation. Multiple customers may use the same underlying infrastructure, but their applications, memory, and storage are supposed to remain separated. In this case, researchers discovered a weakness involving reused storage blocks. Cloudflare explained that the affected shared storage pool had been configured to skip zeroing reused 64 gigabyte blocks. When a container's root disk was deleted, its physical storage blocks were returned to a pool that could later serve workloads belonging to other Cloudflare customers. Normally, reuse storage should be cleared before another tenant receives it, but that wasn't happening correctly. The researchers demonstrated the problem by writing only 4 KB into an unused region of a newly created container disk. That operation could cause a previously used 64 KbB physical block to be allocated to the new container. The attacker's 4KB write replaced only part of that block. The remaining 60 gigabytes could still contain residual information belonging to a previous customer, and that residual information could be sensitive. Researchers demonstrated recovery of material including directory structures, database pages, SQLite databases, Chromium profiles, environment files, and credential files. The testing also demonstrated that this was not simply a one-off laboratory anomaly. Residual material was found on 18 of 24 container placements and across 20 of 22 underlying nodes tested. But there is an important distinction. The researchers were not breaking into an actively running container. They could not choose a specific victim. They did not gain control of the underlying host, and they could not modify another customer's data. The exposure involved residual data from storage blocks previously used by another workload. Cloudflare also says its investigation found no evidence that customer data was actually exposed through malicious exploitation. The researchers themselves use scripts designed to validate the vulnerability and return aggregate information rather than collecting real customer disk contents. Cloudflare has now fixed the issue. The company removed the configuration responsible for skipping block zeroing. It retired existing container disks, and it cleared cached snapshots that could have retained old mappings. Cloudflare says mitigation was completed by September 19th, and customers do not need to take action because the fix was applied to Cloudflare's infrastructure. So why does this matter? Because cloud security depends on boundaries that customers often cannot directly inspect. When you place data inside a multi-tenant cloud platform, you trust the provider to isolate your workload from everyone else sharing the infrastructure. That separation has to exist across compute, memory, networking, and storage. If storage sanitization fails, deleting a workload may not necessarily mean its underlying physical data has disappeared. For security teams, the broader lesson is to think about data lifecycle, not simply data access. What secrets exist inside containers? Are API keys stored in environment files? Are database credentials written to disk? Do temporary workloads contain authentication tokens? How long do those secrets remain valid? And what happens to the underlying storage when the workload disappears? Cloud architecture reduces infrastructure management. It does not eliminate the need to understand where sensitive information exists. Use short-lived credentials. Minimize secrets written to disk. Rotate sensitive credentials, and design applications assuming that secrets deserve protection throughout their entire lifecycle. Because in multi-tenant infrastructure, isolation is not just an architectural feature, it is a security boundary. And when that boundary fails, data that one customer believes is gone can potentially become visible to another. This has been your digital warfare daily brief. Stay secure. We'll see you tomorrow.