Full Report
Cybersecurity researchers have disclosed details of a remote Spectre attack against Cloudflare Workers that leaked a JSON Web Token (JWT) from a co-located Worker in the production environment at up to 12 bits per second, 360 times the rate of an earlier attack demonstrated in 2021. The end-to-end experiment used an attacker Worker and a victim Worker controlled by the researchers,
Analysis Summary
# Vulnerability: Remote Spectre Attack on Cloudflare Workers
## CVE Details
- **CVE ID**: Not explicitly assigned in the report (Spectre-variant side-channel).
- **CVSS Score**: N/A (Research-based side-channel attack).
- **CWE**: CWE-1037 (Processor Side-Channel Leakage), CWE-1259 (Improper Isolation of Shared Resources).
## Affected Systems
- **Products**: Cloudflare Workers (Serverless Platform).
- **Versions**: Production environments prior to August 2026 mitigations.
- **Configurations**: Multi-tenant environments where "Dynamic Process Isolation" (DyPrIs) was the primary defense on Linux servers using AMD EPYC Zen 2 and Zen 3 processors.
## Vulnerability Description
This is an advanced remote Spectre (speculative execution) attack that bypasses Cloudflare’s "Dynamic Process Isolation" (DyPrIs). Cloudflare Workers use Google's V8 isolates to run multi-tenant code within a single OS process to reduce latency.
The researchers identified two primary flaws:
1. **DyPrIs Evasion via I/O**: High WebSocket I/O activity increases instruction translation lookaside buffer (iTLB) activity, which "muffles" the branch-misprediction signal used by DyPrIs to detect Spectre attacks.
2. **Durable Object Persistence**: Attackers can use "Durable Objects" to keep a Worker isolate alive for 5 to 20+ hours, providing enough time to perform slow data leakage before the system triggers process-level isolation.
## Exploitation
- **Status**: PoC demonstrated by researchers in a production environment (no evidence of wild exploitation).
- **Complexity**: High (Requires precise timing and co-location).
- **Attack Vector**: Network (Remote execution of JavaScript via Worker).
## Impact
- **Confidentiality**: High (Leakage rate of 12 bits per second; capable of stealing JWTs or cryptographic keys from co-located tenants).
- **Integrity**: None.
- **Availability**: None.
## Remediation
### Patches
Cloudflare has deployed the following mitigations to production:
- **Enhanced DyPrIs**: Improved detection sensitivity for side-channel signals.
- **V8 Sandbox**: Implementation of the V8 Sandbox to restrict transient access to 64-bit pointers.
- **MPK-based Isolation**: Leveraging Intel/AMD Memory Protection Keys (MPK) to place Worker heaps behind hardware-enforced isolation within the same process.
### Workarounds
- **Timer Coarsening**: Cloudflare continues to coarsen or freeze local timing sources to make side-channel measurements more difficult.
- **Zero-Trust Architectures**: Ensuring short-lived tokens to minimize the utility of leaked data.
## Detection
- **Indicators of Compromise**: High volumes of WebSocket I/O combined with long-lived Durable Object invocations from a single tenant.
- **Detection Methods**: Monitoring for abnormal branch-misprediction signals and iTLB activity at the kernel/hardware level.
## References
- Cloudflare Research: [https://blog.cloudflare[.]com/spectre-research-with-tu-graz/]
- Arxiv Research Paper: [https://arxiv[.]org/abs/2608.17043]
- V8 Sandbox Project: [https://thehackernews[.]com/2024/04/google-chrome-adds-v8-sandbox-new.html]