Re-evaluation of Remote Spectre Attacks on Cloudflare Workers

Based on an assessment of remote Spectre attacks in 2021, Cloudflare introduced a production defense mechanism called DyPrIs (Dynamic Process Isolation). As Spectre attack mitigation techniques evolved, the company decided to re-evaluate whether new techniques pose a threat to the Workers production environment.

The research team built an updated proof-of-concept (PoC) in the production environment to empirically assess the risk of Spectre attacks under real workloads. For an external attacker to successfully execute side-channel attacks in production, they must overcome additional barriers such as shared hardware resource activity, interrupts, context switches, and low-resolution timers.

The study revealed limitations in the existing DyPrIs implementation, demonstrating a remote Spectre attack that leaked 12 bits per second (12 bit/s) of data with 99% accuracy in the production environment. Based on these findings, Cloudflare improved DyPrIs and integrated the V8 sandbox and in-process isolation mechanisms to further reduce the risk of memory information leakage attacks.

This attack has already been mitigated in production systems due to countermeasures applied by the Cloudflare Workers runtime team. No signs of active exploitation have been detected over the past three years.