Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

Post reply on HN
Print view View original

811–820 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#811

Post by kijin »

floatboth wrote: post #798
markonen wrote: post #779

Earlier quoted context omitted.

Once your origin is under a DDoS attack, how would Cloudflare's proxy help?

Yeah, it wouldn't help if the attackers don't resolve the DNS hostname on ~every request :D But then, there are ways to find the origin anyway (when buttflare is enabled), someone in this thread posted the real IP address of Hacker News…

Buttflare exposes the origin IP only if you previously exposed it (e.g. by continuing to use the same IP after signing up for Cloudflare), temporarily exposed it (e.g. by turning off the "cloud" button for a few minutes), or have a bug in your code that exposes it (e.g. by sending emails or requesting external resources from your origin IP). If you pay $200 or more and never do any of these silly things, your origin IP should be safe.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#812

Post by problems »

vermontdevil wrote: post #804

I got an email from Cloudflare and here's an excerpt about the # of sites affected by this. Not sure what to make of it - the low number of domains affected. ==================================== In our review of these third party caches, we discovered data that had been exposed from approximately 150 of Cloudflare's customers across our Free, Pro, Business, and Enterprise plans. We have reached out to these customers…

Yeah, I got this this morning too. It seems to be a pretty big downplay - it should be closer to "change all your passwords, have all your customers change all their passwords". They're busy shredding data from caches, but anyone scraping cloudflare sites in recent days might have data around that they'll never know about.

But I don't blame them entirely - it's unlikely this will have been used and unlikely a given customer's data would be present, so it'd induce panic which would probably never have resulted in an attack.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#814

Post by kowdermeister »

DangerousPie wrote: post #155

Has anybody else actually received an email from Cloudflare about this? I'm a paying customer, but haven't heard anything from them yet. I hope they don't expect they can leave it at a random blog post that will go by unnoticed?

I have received 2 emails mentioning many things listed here and also letting me know that my domain was not affected.

---

Dear Cloudflare Customer:

Thursday afternoon, we published a blog post describing a memory leak caused by a serious bug that impacted Cloudflare's systems. If you haven't yet, I encourage you to read that post on the bug:

https://blog.cloudflare.com/incident-report-on-memory-leak-c...

While we resolved the bug within hours of it being reported to us, there was an ongoing risk that some of our customers' sensitive information could still be available through third party caches, such as the Google search cache.

Over the last week, we've worked with these caches to discover what customers may have had sensitive information exposed and ensure that the caches are purged. We waited to disclose the bug publicly until after these caches could be cleared in order to mitigate the ability of malicious individuals to exploit any exposed data.

In our review of these third party caches, we discovered data that had been exposed from approximately 150 of Cloudflare's customers across our Free, Pro, Business, and Enterprise plans. We have reached out to these customers directly to provide them with a copy of the data that was exposed, help them understand its impact, and help them mitigate that impact.

Fortunately, your domain is not one of the domains where we have discovered exposed data in any third party caches. The bug has been patched so it is no longer leaking data. However, we continue to work with these caches to review their records and help them purge any exposed data we find. If we discover any data leaked about your domains during this search, we will reach out to you directly and provide you full details of what we have found.

To date, we have yet to find any instance of the bug being exploited, but we recommend if you are concerned that you invalidate and reissue any persistent secrets, such as long lived session identifiers, tokens or keys. Due to the nature of the bug, customer SSL keys were not exposed and do not need to be rotated.

Again, if we discover new information that impacts you, we will reach out to you directly. In the meantime, if you have any questions or concerns, please don’t hesitate to reach out.

Matthew Prince Cloudflare, Inc. Co-founder and CEO

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#815

Post by forgottenpass »

markonen wrote: post #779
floatboth wrote: post #766

Earlier quoted context omitted.

However, I haven't seen people enable ButtFlare's proxy only when under DDoS. Most of their users enable the proxying just for the CDN performance or just in case or… you get the idea.

Once your origin is under a DDoS attack, how would Cloudflare's proxy help?

You stand up the service somewhere else, and point the cloudflare proxy at that.

Everyone in the "cloud" is able to do the migration even without having prepared a disaster recovery plan ahead of time.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#817

Post by faragon »

Does anyone know if there is a way for mapping virtual addresses to areas with zeroes and replacing it with the memset to 0 on write access, so software could be still efficient without calling calloc() instead of malloc()? (i.e. memset to 0 only for actually written zones)

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#818

Post by compuguy »

eridius wrote: post #146
gkop wrote: post #103

Earlier quoted context omitted.

> it's also secure against anyone passively sniffing the traffic between the website server and CloudFlare How is it secure? CloudFlare allows you to send this traffic in the clear. If they required this traffic be HTTPS, that would be far better for web security.

My bad. I thought Flexible SSL was the option where you can use any arbitrary self-signed cert. But you're right, Flexible SSL means no encryption at all between the origin server and CloudFlare. I will edit my post accordingly.

What if the origin server forces https on the link between CF and the origin server?

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#819

Post by sillysaurus3 »

user5994461 wrote: post #737
firebones wrote: post #516

Earlier quoted context omitted.

That's what was observed on the Cloudflare end. Without the multiplicand of how many pages Cloudflare served in a given amount of time, you can't determine the impact. Assuming that affected sites were affected en masse, a targeted attack from a connection would be minuscule compared to the pages Cloudflare serves. Cloudflare is serving up more than 100Mbps; the attacker only has to zero in on what's fruitful, which…

Mid 2016 they were serving 4M requests per second.

Thank you. This is exactly the missing piece of information that everybody should be aware of.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#820

Post by [deleted] »

tannhaeuser wrote: post #728
tannhaeuser wrote: post #680

Holy sh*t. Is this the end of Cloudflare with the trust being absolutely destroyed and lawsuits coming in? Can't say I'm sad for them. Cloudflare sells you DDOS protection, and hosts (eg. masks the IP of) the very DDOSers to protect against themselves, which I find bordering on the criminal. Hosters like Hetzner, OVH have for a year now offered DDOS protection (I'm guessing it's heuristic rate limiting, but they won'…

From https://arstechnica.com/security/2017/02/serious-cloudflare-... : A while later, we figured out how to reproduce the problem. It looked like that if an html page hosted behind cloudflare had a specific combination of unbalanced tags, [...] The leakage was the result of a bug in an HTML parser chain Cloudflare uses to modify Web pages as they pass through the service's edge servers. Ahem, at the risk of sounding…

[deleted]
Post reply on HN