A revisit of remote Spectre attacks on Cloudflare Workers

Cloudflare Blog reports that researchers revisited remote Spectre attacks on its Workers platform and uncovered a limitation in the Dynamic Process Isolation defense. By building a proof‑of‑concept, they demonstrated a remote attack that could leak up to twelve bits per second with ninety‑nine percent accuracy even while under production workloads. The paper, covering research from twenty twenty‑four and early twenty twenty‑five, says the flaw has already been mitigated through an improved isolation layer and the integration of the V8 Sandbox, and that no evidence of active exploitation has been seen in the past three years. Spectre, the speculative‑execution side‑channel first disclosed in twenty eighteen, can let transient reads access out‑of‑bounds memory, which Cloudflare now thwarts by freezing timers, disabling shared memory and isolating suspicious scripts.

Listen to this story

Hear this and more stories in a personalized audio briefing.

Open The Chonkerton