Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

Post reply on HN
Print view View original

411–420 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#411

Post by tony101 »

zaatar wrote: post #153
arestor wrote: post #116

Earlier quoted context omitted.

Some features had a bug which lead to uninitialized memory (AKA previous memory contents) in the output of a malformed HTML page was requested. As one such server handles many sites, everything that the server handled before that request may be compromised. This includes all HTTP-GET/POST data (credentials, direct messages to other users, ...), Headers (API tokens, Login-Cookies) and contents. So, you have to assume…

Where is a reliable list of CF-protected websites so I may identify which ones I have interacted with?

An unofficial list is being compiled here: https://github.com/pirate/sites-using-cloudflare

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#412

Post by nikisweeting »

I've compiled a list of 7,385,121 domains served through cloudflare using several scrapers. https://github.com/pirate/sites-using-cloudflare

The full list is available for download here (23mb) https://github.com/pirate/sites-using-cloudflare/raw/master/...

I will be updating it as I find more domains.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#413

Post by nikisweeting »

wilde wrote: post #247
jgrahamc wrote: post #113

Earlier quoted context omitted.

We identified 3,438 unique domains. I'm not sure if those were all sent to Tavis because we were only sending him things that we wanted purged.

Are you guys planning to release the list so we can all change our passwords on affected services? Or are you planning on letting those services handle the communication?

I've compiled a list of 7,385,121 domains that use Cloudflare here: https://github.com/pirate/sites-using-cloudflare

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#414

Post by ers35 »

misframer wrote: post #390
ers35 wrote: post #99

Hacker News uses Cloudflare: http://bgp.he.net/dns/news.ycombinator.com#_ipinfo Add the following to your hosts file to bypass Cloudflare and access HN directly: 50.22.90.248 news.ycombinator.com

How did you find that IP?

I used Censys to search for the IPv4 addresses of servers serving matching TLS certificates: https://censys.io/ipv4?q=443.https.tls.certificate.parsed.na...

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#415

Post by infinity0 »

amalcon wrote: post #360
infinity0 wrote: post #307

Earlier quoted context omitted.

Could someone enlighten me on why malloc and free don't automatically zero memory by default? Someone pointed me to MALLOC_PERTURB_ and I've just run a few test programs with it set - including a stage1 GCC compile, which granted may not be the best test - and it really doesn't dent performance by much. (edit: noticeably, at all , in fact) People who prefer extreme performance over prudent security should be the ones…

Some old IBM environments initialized fresh allocations to 0xDEADBEEF, which had the advantage that the result you got from using such memory would (usually) be obviously incorrect. The fact that it was done decades ago is pretty good evidence that it's not about the actual initialization cost: these things cost a lot more back then. What changed is the paged memory model: modern systems don't actually tie an address…

Parsers don't usually need to hold onto what they're parsing for a very long time, so unless they were running this parallel on a machine with 4k cores, I'd imagine it would be much more likely that a buffer overrun hits the middle of an already-freed allocation rather than going into an active one.

In terms of "wasting" memory, perhaps the kernel could detect that you are writing 0s to a COW 0 page and still not actually tie the page to physical RAM. (If you're overwriting non-0 data, well it's already in a physical page.)

I don't quite follow the details of the CPU cache issue and why that is more-than-minor.

I do think in this day and age we should be re-visiting this question seriously in our C standard libraries. If the performance issues are actually major problems for specific systems, the old behaviour could be kept, but after benchmarking to show that it really is a performance problem.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#416

Post by cjbprime »

ppoint wrote: post #400
infinity0 wrote: post #307

Earlier quoted context omitted.

Could someone enlighten me on why malloc and free don't automatically zero memory by default? Someone pointed me to MALLOC_PERTURB_ and I've just run a few test programs with it set - including a stage1 GCC compile, which granted may not be the best test - and it really doesn't dent performance by much. (edit: noticeably, at all , in fact) People who prefer extreme performance over prudent security should be the ones…

calloc zeroes memory on allocation.

Yes, I think the question was something like "why doesn't malloc call calloc?".

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#417

Post by nikisweeting »

sarcasmic wrote: post #408
benwilber0 wrote: post #312

Earlier quoted context omitted.

Well fuck. I have no idea what (if any, or all) of my authenticated web sessions have been going through CloudFlare in the last 6 months. How do I even start to protect myself from this?

1. rotate passwords, tokens, auth stuff on any and all service you use that may have used CloudFlare in this time period (as of time of writing this list has not been enumerated) 2. hope that no personally-identifiable info or damaging plaintext that can be tied back to you has been exposed, but you will probably never know for sure 3. join class action lawsuits if you so desire and receive the chump change that is y…

I've compiled a list of 7 million+ domains that use Cloudflare here: https://github.com/pirate/sites-using-cloudflare

Including the subset of the Alexa 10,000 that use Cloudflare in the README.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#418

Post by [deleted] »

zaatar wrote: post #153
arestor wrote: post #116

Earlier quoted context omitted.

Some features had a bug which lead to uninitialized memory (AKA previous memory contents) in the output of a malformed HTML page was requested. As one such server handles many sites, everything that the server handled before that request may be compromised. This includes all HTTP-GET/POST data (credentials, direct messages to other users, ...), Headers (API tokens, Login-Cookies) and contents. So, you have to assume…

Where is a reliable list of CF-protected websites so I may identify which ones I have interacted with?

[deleted]

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#419

Post by nikisweeting »

curuinor wrote: post #401
nikisweeting wrote: post #354

Earlier quoted context omitted.

I'm compiling a list of affected domains here, please submit PRs: https://github.com/pirate/sites-using-cloudflare I'm currently running a DNS scraper to find more.

You should probably keep the porn sites on the list, folks have accounts at porn sites too

Good point, will do.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#420

Post by AYBABTME »

belovedeagle wrote: post #395
AYBABTME wrote: post #317

This comes around to me as something that just shouldn't have happened. CloudFlare are pretty big on Go, as far as I can tell (and I guess Lua for scripting nginx). Why was this parsing package written in a non memory-safe language? Parsing is one of those "obvious" things easy to mess up; the likelihood of a custom, hand written parser being buggy is pretty high. If it's somehow understood that your library is likel…

Memory safe languages aren't a panacea. There could just as easily have been a bug in the compiler or standard library with the same result.

Sure... but that probability is equally present in the non memory-safe language, so that doesn't change anything.
Post reply on HN