Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

Post reply on HN
Print view View original

151–160 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#151

Post by tr32q423 »

The root cause is apparently coming from auto-generated code that causes buffer overrun:

    /* generated code */
    if ( ++p == pe )
        goto _test_eof;
With the help of Google, Yahoo, Bing and others, we found 770 unique URIs that had been cached and which contained leaked memory. Those 770 unique URIs covered 161 unique domains.

The examples in the report shows Uber, okcupid , etc. It would be good to know the full list, to know what password might have been compromised.

https://blog.cloudflare.com/incident-report-on-memory-leak-c...

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#152

Post by artursapek »

davb wrote: post #61
loeg wrote: post #46

Anyone know which password manager uses Cloudflare? Just trying to figure out if I'm affected.

Thankfully it looks like it's not 1Password, who seem to use AWS CloudFront.

I just checked them too, but they may have just switched over.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#153

Post by zaatar »

arestor wrote: post #116
sparkling wrote: post #77

I know what Cloudflare is but i don't quite understand the underlying issue. Can someone explain in simpler terms what happened here and how it a) affects sites using Cloudflare and b) Users accessing sites with Cloudflare?

Some features had a bug which lead to uninitialized memory (AKA previous memory contents) in the output of a malformed HTML page was requested. As one such server handles many sites, everything that the server handled before that request may be compromised. This includes all HTTP-GET/POST data (credentials, direct messages to other users, ...), Headers (API tokens, Login-Cookies) and contents. So, you have to assume…

Where is a reliable list of CF-protected websites so I may identify which ones I have interacted with?

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#154

Post by taviso »

rdl wrote: post #135
jgrahamc wrote: post #113

Earlier quoted context omitted.

We identified 3,438 unique domains. I'm not sure if those were all sent to Tavis because we were only sending him things that we wanted purged.

3438 domains which someone could have queried, but potentially data from any site which had "recently" passed through Cloudflare would be exposed in response, right? Purging those results helps with search engines, but a hypothetical malicious secret crawler would still potentially have any data from any site.

correct

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#156

Post by rdl »

taviso wrote: post #154
rdl wrote: post #135

Earlier quoted context omitted.

3438 domains which someone could have queried, but potentially data from any site which had "recently" passed through Cloudflare would be exposed in response, right? Purging those results helps with search engines, but a hypothetical malicious secret crawler would still potentially have any data from any site.

correct

fuck :(

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#157

Post by tony101 »

eridius wrote: post #120
JoshTriplett wrote: post #73

Earlier quoted context omitted.

> A site using Flexible SSL is no less secure than one using http:// , It can be, in several ways. Most critically, it stops browsers from detecting the connection as insecure and applying mitigations.

Beyond Secure cookies, what mitigations are you thinking of? Secure cookies don't count because serving Secure cookies over Flexible SSL is no less secure than serving regular cookies over http:// .

Many browser features (like location API) are gradually being deprecated from plaintext HTTP.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#158

Post by jjoe »

simcop2387 wrote: post #145
StavrosK wrote: post #84

Earlier quoted context omitted.

Everyone: HN should implement U2F or TOTP so we don't need to only rely on passwords :(

How do i get the key information to HN without passing through cloudflare so that someone could sniff it?

Someone just posted how: https://news.ycombinator.com/item?id=13719366

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#159

Post by aidos »

tptacek wrote: post #129
jgrahamc wrote: post #113

Earlier quoted context omitted.

We identified 3,438 unique domains. I'm not sure if those were all sent to Tavis because we were only sending him things that we wanted purged.

What anomalies would be apparent in your logs if someone malicious had discovered this flaw and used it to generate a large corpus of leaked HTTP content?

That's also what I'm interested in. There's a lot of talk about the sites that had the features enabled that allowed the data to escape, but it's the sites that were co-existing with those that were in danger.

In terms of the caching, knowing the broken sites tells you where to look in the caches after the fact, but do you have any idea of who's data was leaked? Presumably 2 consecutive requests to the same malformed page could/would leak different data.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#160

Post by daenney »

philip1209 wrote: post #126

Interesting. Cloudflare uses a lot of Go, which should hypothetically be memory safe. Was this system in Go? If so, I would be interested in seeing proof of concept code for a vulnerability like this.

Their old Ragel-based parser was affected. According to their post mortem both the old parser and the new cf-html one are compiled as nginx modules so I'd venture a guess that this is probably C/C++ code since afaik you can't extend nginx through modules written in Go.

> It turned out that the underlying bug that caused the memory leak had been present in our Ragel-based parser for many years but no memory was leaked because of the way the internal NGINX buffers were used. Introducing cf-html subtly changed the buffering which enabled the leakage even though there were no problems in cf-html itself.

https://blog.cloudflare.com/incident-report-on-memory-leak-c...

There's a section in that blog post titled "Root cause of the bug" that goes in further detail.

Post reply on HN