How Cloudflare addressed a cross-tenant data exposure vulnerability in Containers

• The flaw came from dm-thin storage pools configured with skip_block_zeroing: when a reused 64 KiB block received a smaller write, the rest of the block could still hold data from a previous container.
• The proof of concept wrote one 4 KiB block into each 64 KiB region of ext4 free space, forcing allocation of a reused block, then read the raw /dev/vdc device to see the 60 KiB it never wrote.
• The researchers found residual material on 18 of 24 placements and 20 of 22 nodes, including directory structures, database pages, and complete SQLite databases, but could not target a chosen customer or an attached disk.
• Cloudflare says turning block zeroing back on was not enough: blocks already mapped into running disks and cached image-layer snapshots stayed readable, so it drained hosts, restarted VMs, and cleared image caches.
• Cloudflare built detection signatures from the small-write, large-read pattern and ran them over retained disk-I/O telemetry, finding only activity from the researchers and its own engineers.

• AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.

Cloudflare Sandboxes are widely used to run AI agent workloads, so a cross-tenant disk-residue flaw on that shared infrastructure is directly relevant to anyone running untrusted or multi-customer agent code there.

• blogDogfooding at scale: migrating cdnjs to Cloudflare's Developer PlatformSimona Badoiu
• blogIntroducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak modelsblog.cloudflare.com
• postSPACE separates agent sessions from the sandboxes that run themPerplexity

Checking sign-in…

Loading comments…