Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

441–450 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#441

Earlier quoted context omitted.

Some old IBM environments initialized fresh allocations to 0xDEADBEEF, which had the advantage that the result you got from using such memory would (usually) be obviously incorrect. The fact that it was done decades ago is pretty good evidence that it's not about the actual initialization cost: these things cost a lot more back then. What changed is the paged memory model: modern systems don't actually tie an address…

Parsers don't usually need to hold onto what they're parsing for a very long time, so unless they were running this parallel on a machine with 4k cores, I'd imagine it would be much more likely that a buffer overrun hits the middle of an already-freed allocation rather than going into an active one. In terms of "wasting" memory, perhaps the kernel could detect that you are writing 0s to a COW 0 page and still not act…

In terms of "wasting" memory, perhaps the kernel could detect that you are writing 0s to a COW 0 page and still not actually tie the page to physical RAM.

Writing to your COW zero page causes a page fault. Now, in theory you could disassemble the executing instruction and if it's some kind of zero write, just bump the instruction pointer and go back to userspace - but then the very next instruction in your loop that zeroes the next 8 bytes will cause the same page fault. And the next. And the next...

Taking a page fault for every 8 bytes in your allocation is completely infeasible. You'd be better off taking the hit of the additional memory usage.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#442
post #4

Oh, my god. Read the whole event log. If you were behind Cloudflare and it was proxying sensitive data (the contents of HTTP POSTs, &c), they've potentially been spraying it into caches all across the Internet; it was so bad that Tavis found it by accident just looking through Google search results. The crazy thing here is that the Project Zero people were joking last night about a disclosure that was going to keep e…

It is far from over, too! Google Cache still has loads of sensitive information, a link away! Look at this, click on the downward arrow, "Cached": https://www.google.com/search?q="CF-Host-Origin-IP:"+"author... (And then, in Google Cache, "view source", search for "authorization".) (Various combinations of HTTP headers to search for yield more results.)

Time to find out where various "booter" sites are actually hiding.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#443
post #374

I'm a little drunk so please forgive me if I'm way off base here or if I'm ultimately describing a service that already exists. Unless I'm mistaken, CloudFlare's services necessarily require they act as a MITM. Would it be possible or practical change the DDoS protection service such that it uses an agent on the customer's end (the CF customer) that relays relevant data to CF, instead of having CF MITM all data? As i…

I think you have yourself a solid company idea right there. Go for it.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#444
post #256

This might be the time to point out the CloudFlare watch blog: http://crimeflare.com/

The thesis of that blog seems to be that Cloudflare should be censoring content and deciding who gets to have websites on the internet.

So you think businesses have no responsibility to police themselves and their users? If a shop was caught knowingly facilitating say welfare fraud they'd get fined up the wazoo but for some reason being ~digital~ makes it OK?

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#445
post #2

Full details from Cloudflare: https://blog.cloudflare.com/incident-report-on-memory-leak-c...

Why is your company severely downplaying it? Honestly, this is the biggest security incident in a long time, and proper mitigation would probably warrant: - forcefully terminating all cookies on CloudFlare sites, cloudflare already injects JS onto the page anyway - MITMing all CloudFlare sites with a warning for users to change their passwords

> MITMing all CloudFlare sites with a warning for users to change their passwords

REALLY?

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#446
post #436

Earlier quoted context omitted.

Note that for sites like HN, changing your password doesn't expire other sessions. You have to go find every browser with an HN cookie and logout. (Where I mean some other sites that are not at all HN, but might plausibly exist.)

No, we log you out of all HN sessions when you change your password.

Oh, cool. (This was not the case last time I did a reset.)

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#447

Can we start a list of affected right now? I found: OKCupid Uber people claiming 1Password, can't find Reddit Lyft Yelp Pingdom Digital Ocean Montecito Bank and Trust

Is your list "customers of cloudflare" or "customers of cloudflare that could have sensitive data cached by search engines" For example, Digital Ocean uses cloudflare, but the domain with sensitive data (cloud.digitalocean.com) is entirely blocked from Search Engines https://cloud.digitalocean.com/robots.txt

It doesn't matter, your info could have leaked via other sites.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#449

Earlier quoted context omitted.

So just to clarify: some bug makes Cloudflare leak the HTTP Headers into the HTML being served and those HTML pages containing sensitive Info got cached by Google (and others)?

Yes. Think of it this way. You have a function that strips all colons from your input. For some reason - in certain cases - your code misbehaves and when you are replacing the colons with an empty character you accidentally replace that colon with other data you have in the memory. So now all the colons in your input have been replaced with data that you shouldn't have touched. So now whoever sent you an input, gets…

But how is Google getting headers from the users of the sites, it should be from their crawler

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#450
post #345

What's the rationale behind sending user PII through a CDN? Presumably that is useful to that one user only so a CDN wouldn't be super useful in distributing the load across its edges. Also doesn't CDN caching kinda defeat the purpose of having SSL?

Cloudflare terminates SSL and then forwards the request to your servers as one of their services. This isn't about the CDN, but about them terminating SSL, then leaking the plaintext data back through other requests.

What are the benefits of terminating SSL early at the CDN level? It seems to me the risks associated with not having SSL still remain they're just shifted to between the CDN and the backend. Is it much more than just giving lip service to SSL and getting away with things like browser restrictions, etc.?
Post reply on HN