Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

Post reply on HN
Print view View original

761–770 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#761

Post by aidos »

dbmnt wrote: post #711
nikisweeting wrote: post #413

Earlier quoted context omitted.

I've compiled a list of 7,385,121 domains that use Cloudflare here: https://github.com/pirate/sites-using-cloudflare

This list is misguided. It's just a dump of sites using Cloudflare's DNS, a hugely popular and (mostly) free service. The vulnerability only affected customers using Cloudflare's paid SSL proxy (CDN) service. The latter is a much smaller subset. Even then, only a subset of the SSL proxy users, those with certain options enabled that caused traffic to go through a vulnerable parser, were really impacted. I'm not sure…

At least some of this is incorrect. The issue is NOT the pages running through the parser — the issue is the traffic running through the same nginx instance as vulnerable pages.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#763

Post by midgetjones »

_wmd wrote: post #91
tptacek wrote: post #79

Earlier quoted context omitted.

In case you're wondering how this could be worse than Heartbleed: Yes, apparently the allocation patterns inside Cloudflare mean TLS keys aren't exposed to this vulnerability. But Heartbleed happened at the TLS layer. To get secrets from Heartbleed, you had to make a particular TLS request that nobody normally makes. Cloudbleed is a bug in Cloudflare's HTML parser, and the secrets it discloses are mixed in with, appa…

It shouldn't be too difficult to feed an instrumented copy of the parser some fraction of their cached pages (after all, that's what they're for.. right?) and calculate a percentage of how many triggered e.g. valgrind, or just some magic string tacked on the end of the input appearing in the output or similar I prefer CloudScare to Cloudbleed :)

ShitFest

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#764

Post by breakingcups »

gukov wrote: post #581
mattbee wrote: post #219

Earlier quoted context omitted.

This assumes that the Bad Guys hadn't noticed the bug before Tavis, and hadn't started intensively mining Cloudflare for data.

I hope something like intense mining would've caused a detectable spike in turn alerting CF sooner. Looks like it didn't...

Probably not. Cloudflare is designed to automatically swallow large increases in traffic.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#765

Post by ThePhysicist »

dbmnt wrote: post #711
nikisweeting wrote: post #413

Earlier quoted context omitted.

I've compiled a list of 7,385,121 domains that use Cloudflare here: https://github.com/pirate/sites-using-cloudflare

This list is misguided. It's just a dump of sites using Cloudflare's DNS, a hugely popular and (mostly) free service. The vulnerability only affected customers using Cloudflare's paid SSL proxy (CDN) service. The latter is a much smaller subset. Even then, only a subset of the SSL proxy users, those with certain options enabled that caused traffic to go through a vulnerable parser, were really impacted. I'm not sure…

This is not correct in my understanding: The sites with certain options enabled produced the erroneous behavior, but the data that would get leaked through this behavior could be from any site that uses Cloudflare SSL (as this requires Cloudflare to tunnel SSL traffic through their servers, decrypt it and re-encrypt it with their wildcard certificate). So if I understand correctly anyone using the (free) Cloudflare SSL service in combination with their DNS is affected.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#766

Post by floatboth »

oddratios wrote: post #692
hueving wrote: post #493

Earlier quoted context omitted.

So rather than demand fixes for the fundamental issues that enable ddos attacks (preventing IP spoofing, allowing infected computers to remain connected, etc), we just continue down this path of massive centralization of services into a few big players that can afford the arms race against bonnets. Using services like Cloudflare as a 'fix' is wrecking the decentralized principles of the Internet. At that point we mig…

When in a tactical emergency do not say "and why is this shit raining down upon us?" That is a separate step. First you either take cover or help.

However, I haven't seen people enable ButtFlare's proxy only when under DDoS. Most of their users enable the proxying just for the CDN performance or just in case or… you get the idea.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#767

Post by raverbashing »

CapacitorSet wrote: post #5

>Cloudflare pointed out their bug bounty program, but I noticed it has a top-tier reward of a t-shirt. Considering the amount and sensitivity of the data they handle, I'm not sure a t-shirt is an appropriate top-tier reward.

Good to know the security of their users is worth a t-shirt

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#768

Post by ing33k »

bubblethink wrote: post #83
joepie91_ wrote: post #52

Earlier quoted context omitted.

> My second thought after relief was the realization that even as a consumer I'm affected by this, my password manager has > 100 entries what percentage of them are using CloudFlare? Should I change all my passwords? Yes. Right now. Don't wait for the vendor to notify you. > What an epic mess. This is the problem with centralization, the system is broken. Yep.

How do you check if a website uses cloudflare ? Any scripts that do that ?

I know it's kinda late,but there is one more way to find if a site is using Cloudflare

append /cdn-cgi/trace to the URL and you will some debug info

Ex:

https://cloud.digitalocean.com/cdn-cgi/trace

https://news.ycombinator.com/cdn-cgi/trace

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#769

Post by dajohnson89 »

mcintyre1994 wrote: post #709
tinco wrote: post #696

Earlier quoted context omitted.

Well HIPAA wouldnt allow your https traffic flow unencrypted through a shared proxy right? This means cloudflare couldnt offer that feature, so they probably didn't? Just think about the HIPAA document describing a single endpoint of dozens of sensitive datastreams, decrypting and then encrypting them all on the same machine, a machine that does some random HTML parsing for snippet caching on the side. I don't see th…

From their blog post: https://blog.cloudflare.com/incident-report-on-memory-leak-c... "Because Cloudflare operates a large, shared infrastructure an HTTP request to a Cloudflare web site that was vulnerable to this problem could reveal information about an unrelated other Cloudflare site." You don't need to be using this feature, or to be sending malformed HTML yourself - just to be in memory for this Cloudflare proc…

Why isn't the cloudflare encrypted with HTTPS??

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#770

Post by drvdevd »

ars wrote: post #704
AYBABTME wrote: post #317

This comes around to me as something that just shouldn't have happened. CloudFlare are pretty big on Go, as far as I can tell (and I guess Lua for scripting nginx). Why was this parsing package written in a non memory-safe language? Parsing is one of those "obvious" things easy to mess up; the likelihood of a custom, hand written parser being buggy is pretty high. If it's somehow understood that your library is likel…

This could easily happen in Go as well. All that would be needed is to reuse the buffer in between requests, and rely on the buffer length instead of clearing it. To make it safer you would need to deallocate and reallocate the buffer for each request, but that might be slow. Doing that would fix it for Go, or for C, it would be the same either way. So I'm not convinced that using Go would have helped here.

I agree. I keep seeing comments about C being the culprit, but in my mind, this is more of a policy issue regarding how any given language initializes and allocates memory.

Sure, in this case, we may see a C-specific bug in play, but I think this sort of bug is more effectively mitigated by forcing buffers to be zero-filled upon allocation and/or deallocation, and perhaps system-wide at the OS level, rather than relying upon language features to cover it.

So - I'm not explicitly defending C here - I just don't think a similar bug could never occur in a "memory safe" language as well.

Post reply on HN