Researchers Breach Cloudflare Workers with High-Speed Remote Spectre Attack

Researchers from TU Graz have successfully executed a remote Spectre attack against Cloudflare Workers' production environment, demonstrating that existing software-level defenses can be bypassed to steal sensitive data. The attack allowed the team to leak a JSON Web Token (JWT) from a co-located victim worker, proving that multi-tenant cloud environments remain vulnerable to sophisticated microarchitectural exploits.

By utilizing microarchitectural amplification and "remote timers," the researchers achieved a massive increase in data exfiltration speeds. While previous attacks of this nature were limited to roughly 2 bits per minute, the TU Graz method reached speeds of up to 12 bits per second with an accuracy rate of 99.16%. This acceleration transforms Spectre from a theoretical risk into a practical tool for extracting credentials and secrets in real-time.

The Isolation Gap

Cloudflare Workers utilizes language-level isolation rather than traditional process-isolation to minimize start-up latency for its users. While this architecture enables high performance, it is inherently susceptible to Spectre-style attacks, which exploit the speculative execution features of modern CPUs to leak data across isolation boundaries. To counter this, Cloudflare had previously relied on restricted timers and a system called Dynamic Process Isolation (DyPrIs).

However, the TU Graz research revealed that DyPrIs was insufficient against these new amplification techniques. The researchers were able to circumvent these protections, demonstrating that software-based isolation and basic timer restrictions cannot fully stop an attacker capable of leveraging remote timers to measure microarchitectural state changes.

Industry Implications

The ability to remotely leak JWT tokens at high speeds poses a direct risk to customer data in multi-tenant cloud environments. This breach highlights a critical systemic weakness: as attackers develop more efficient ways to amplify microarchitectural leaks, the industry can no longer rely solely on software-level sandboxing. The shift toward hardware-assisted isolation is no longer optional but necessary to maintain the integrity of shared computing resources.

The Path to Mitigation

In response to these findings, Cloudflare has implemented a multi-layered defense strategy to close the vulnerability. The company integrated the V8 Sandbox, which limits transient access to 64-bit pointers, and enhanced the detection capabilities of its DyPrIs system. Most significantly, Cloudflare has deployed hardware-assisted MPK-based (Memory Protection Keys) in-process isolation for tenant heaps, providing a more robust physical barrier between co-located workers.

Security analysts will now be watching to see if similar amplification techniques can be applied to other serverless platforms that prioritize low-latency startup over strict process isolation.