Cybersecurity researchers have demonstrated a remote Spectre attack against Cloudflare Workers that leaked a JSON Web Token from a co-located Worker in the production environment at up to 12 bits per second, a 360-fold improvement over a 2021 attack.
The attack, conducted by researchers and described in a paper published on August 19, showed that Cloudflare’s Dynamic Process Isolation (DyPrIs) defense could be bypassed using WebSocket communications as a remote timing source and Durable Objects to maintain long-lived execution contexts. No customer data was accessed during the proof-of-concept experiment.
How the Attack Works
Cloudflare Workers runs code from multiple tenants in separate V8 isolates within the same operating-system process, relying on language-level isolation rather than strict process separation to minimize startup latency. The researchers exploited two weaknesses in DyPrIs: long-lived Durable Object invocations could continue running before isolation kicked in, and heavy WebSocket I/O activity suppressed the branch-misprediction signal that DyPrIs uses to detect malicious behavior.
Using these techniques, the researchers leaked a JWT token bit by bit from a victim Worker’s memory, achieving 99.16% accuracy at the reported 12 bits per second rate. The tests were conducted on Linux servers using AMD EPYC Zen 2 and Zen 3 processors during nighttime hours when CPU utilization was between 10% and 25%.
Cloudflare Responds
Cloudflare said the attack has already been mitigated in production through three layers of defense: improved DyPrIs detection capabilities, the V8 Sandbox which limits transient access to 64-bit pointers, and Memory Protection Keys (MPK)-based in-process isolation that places Worker heaps behind hardware-enforced protection keys. The company said it found no indicators of active exploitation over the last three years.
“We demonstrate that the production implementation of DyPrIs was insufficient,” the researchers stated, arguing that the weaknesses reflected fundamental limitations of the detection approach rather than implementation oversights.
The original 2021 research by Cloudflare and TU Graz demonstrated Spectre attacks against Workers at just 120 bits per hour and introduced DyPrIs as a countermeasure. That earlier work reported a 0.61% false-positive rate and concluded that DyPrIs provided the same security guarantees as strict process isolation against the Spectre variants tested at the time.
The new findings underscore the persistent challenge of securing multi-tenant serverless platforms against hardware-level side-channel attacks. Cloudflare’s MPK-based isolation assigns rotating protection keys to prevent nearby sandboxes from sharing a key, with random MPK assignment alone trapping roughly 92% of cross-isolate accesses. The researchers recommended that robust detection should occur during execution and use signals that cannot be suppressed by I/O activity.
Sources: The Hacker News; Cloudflare Blog; arXiv research paper; TU Graz
discussion