Cloudflare Workers: Remote Spectre Attack Leaks 12 Bits per Second
A revisit of remote Spectre attacks on Cloudflare Workers
In 2021, Cloudflare shipped Dynamic Process Isolation (DyPrIs) to defend against remote Spectre attacks on Workers. A new internal reassessment, detailed in a paper co-authored with TU Graz, found a limitation in DyPrIs and demonstrated a reliable remote Spectre attack in production, leaking up to 12 bit/s with 99% accuracy. The attack was mitigated by improved DyPrIs, the V8 Sandbox, and an in-process isolation mechanism. No active exploitation was found.
Our research uncovered a limitation in the implementation of DyPrIs and we managed to demonstrate a remote Spectre attack reliably leaking up to 12 bit/s with a 99% accuracy in the production environment of Cloudflare Workers.