Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

Post reply on HN
Print view View original

381–390 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#381

Post by kjksf »

infinity0 wrote: post #327
Terr_ wrote: post #322

Earlier quoted context omitted.

Just like why most filesystems don't zero deleted files.

Neither of these are good reasons: I already talked about MALLOC_PERTURB_ (man mallopt) in my post and my naive performance tests, and we rarely get bad security holes based on data from deleted files left on filesystems.

You asked for a reason, not for a good reason.

malloc/free were designed around 1972. That was a time where performance was much more important and security concerns didn't really exists.

Modern systems, like Go, do zero-out newly allocated memory because they do consider a bit more security to be more important than a bit more performance.

But changing the defaults of malloc/free is not really an option and it would probably break stuff.

Especially on Linux, where, I believe, malloc returns uncommitted pages, which increases the perf advantage in some cases.

Security conscious programmers can use calloc() or write their own wrappers over malloc/free.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#382

Post by nikisweeting »

tr32q423 wrote: post #151

The root cause is apparently coming from auto-generated code that causes buffer overrun: /* generated code */ if ( ++p == pe ) goto _test_eof; With the help of Google, Yahoo, Bing and others, we found 770 unique URIs that had been cached and which contained leaked memory. Those 770 unique URIs covered 161 unique domains. The examples in the report shows Uber, okcupid , etc. It would be good to know the full list, to…

We're working on getting a full list up here: https://github.com/pirate/sites-using-cloudflare

I'm currently just searching the Alexa top 10,000 doing DNS scraping, but I'll updating it with reverse resolves from cloudflare.com/ips/ next.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#383

Post by nikisweeting »

ta2987 wrote: post #293

We need an official and comprehensive list of domains served by Cloudflare throughout the affected period.

I'm compiling an unofficial list, hopefully they'll release an official one though:

https://github.com/pirate/sites-using-cloudflare

The issue is they have to get permission from their customers before releasing affected domains.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#384

Post by belovedeagle »

_wmd wrote: post #265
tootie wrote: post #224

Earlier quoted context omitted.

CloudFlare is neither the first nor the biggest CDN. I can't recall Akamai having a hole this big. They're either more secure or better at keeping things quiet.

To be fair to CloudFlare, Google had a heap issue a few years back (maybe like 7 now) where internal flags and copies of argv (which Google use heavily for config) were clearly present in output from their HTTP frontends, including references to Borg before Borg was ever documented publicly. Over in App Engine land, someone bypassed their JVM sandbox and managed to extract a copy of their JVM image, which included mu…

Off topic, but I find it really impressive that Google packed their system into a 500 millibit binary; wow!

Seriously, people, units and prefixes are case-sensitive.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#385

Post by pmahoney »

I haven't found a clear answer to this:

CloudFlare has multiple SSL configurations:

> Flexible SSL: There is an encrypted connection between your website visitors and Cloudflare, but not from Cloudflare to your server.

> Full SSL: Encrypts the connection between your website visitors and Cloudflare, and from Cloudflare to your server

(I'll add Full SSL mode still involves CloudFlare terminating SSL (decrypting) before re-encrypting to communicate to your server)

If I am running in Full SSL mode, is (or was) my data vulnerable to being leaked?

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#386

Post by nathancahill »

user5994461 wrote: post #223
nathancahill wrote: post #185

Earlier quoted context omitted.

I think your estimates fell apart at step 2, 1/1000 pages being cached. HTTP is aggressively cached, on many different layers. I'd put it closer to 1/10.

I meant cached by a public service like Google Cache Bing Archive.org that expose the pages. A browser cache might be 1/10 but that's not open.

There's a lot of stuff in between those two extremes. As someone that operates an HTTP accelerator and caching server.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#387

Post by maknz »

pmahoney wrote: post #385

I haven't found a clear answer to this: CloudFlare has multiple SSL configurations: > Flexible SSL: There is an encrypted connection between your website visitors and Cloudflare, but not from Cloudflare to your server. > Full SSL: Encrypts the connection between your website visitors and Cloudflare, and from Cloudflare to your server (I'll add Full SSL mode still involves CloudFlare terminating SSL (decrypting) befor…

Full SSL requests still terminate at CloudFlare, and would still be vulnerable. It's just that CloudFlare's connection to your origin is also encrypted.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#389

Post by garrettr_ »

infinity0 wrote: post #307
PuffinBlue wrote: post #187

Earlier quoted context omitted.

> The infosec team worked to identify URIs in search engine caches that had leaked memory and get them purged. With the help of Google, Yahoo, Bing and others, we found 770 unique URIs that had been cached and which contained leaked memory. Those 770 unique URIs covered 161 unique domains. The leaked memory has been purged with the help of the search engines. So I tried it too, and there's still data cached there. Am…

Could someone enlighten me on why malloc and free don't automatically zero memory by default? Someone pointed me to MALLOC_PERTURB_ and I've just run a few test programs with it set - including a stage1 GCC compile, which granted may not be the best test - and it really doesn't dent performance by much. (edit: noticeably, at all , in fact) People who prefer extreme performance over prudent security should be the ones…

Zeroing on malloc and/or free would not have prevented this type of error, since the information disclosure was due to an overflow into an adjacent allocated buffer.

However, zeroing on free is generally a useful defense-in-depth measure because can minimize the risk of some types of information disclosure vulnerabilities. If you use grsecurity, this feature is provided by grsecurity's PAX_MEMORY_SANITIZE [0].

[0]: https://en.wikibooks.org/wiki/Grsecurity/Appendix/Grsecurity...

Post reply on HN