Cloudflare mitigates Spectre attack leaking 12 bit/s in Workers

Cloudflare has updated its edge computing platform to address a Spectre-based side-channel attack that could extract data from JavaScript isolates at 12 bits per second. The vulnerability, demonstrated in a 2024-2025 research project, exposed limitations in the company’s Dynamic Process Isolation (DyPrIs) system and prompted hardware-assisted mitigations.

How the attack worked

The exploit targeted Cloudflare Workers, which runs untrusted JavaScript on edge servers using V8 isolates. While Workers employs multiple isolation layers—including Linux namespaces, seccomp filters, and automated V8 patching—speculative execution vulnerabilities like Spectre can bypass these defenses. The attack combined several techniques to overcome production environment challenges:

• Co-location: By invoking a victim Worker from an attacker-controlled script, the scheduler typically placed both isolates in the same process. Durable Objects maintained long-lived execution contexts, ensuring persistent access.
• Remote timer: A WebSocket connection to an external server provided sub-millisecond timing resolution, despite Workers’ deliberate restrictions on local timers.
• Signal amplification: Tree-based pseudo least-recently used (PLRU) cache policies amplified single-bit cache events, making noisy measurements distinguishable.
• Eviction bypass: Instead of constructing precise eviction sets, the attack allocated large memory pools (64 MB) to probabilistically ensure cache lines were uncached.

The attack chain began with leaking compressed heap pointers, then used speculative type confusion to read arbitrary 64-bit addresses. In a controlled test, researchers extracted a JWT token from a victim Worker, achieving 99% accuracy. Performance varied with server load but remained feasible even during peak utilization.

Why DyPrIs failed

Cloudflare’s DyPrIs system monitors hardware performance counters to detect Spectre-like behavior and isolate suspicious scripts. Two factors allowed the attack to evade detection:

1. Long-lived executions: DyPrIs only isolates scripts after invocation completion. The attack used Durable Objects and WebSocket keep-alives to maintain a single invocation for hours, completing data exfiltration before isolation triggered.
2. Normalization flaw: DyPrIs normalized branch mispredictions by iTLB accesses. The attack’s heavy WebSocket I/O inflated iTLB activity, reducing the normalized ratio below detection thresholds.

Mitigation updates

Cloudflare implemented three layers of defense in response:

• V8 Sandbox: Deployed in 2025, this removes raw 64-bit pointers from most of the JavaScript heap, complicating the speculative type-confusion gadget used in the attack.
• Memory Protection Keys (MPK): Hardware-enforced isolation now protects each isolate’s heap from cross-tenant access within the same process. While not a complete Spectre fix, MPK reduces the attack surface.
• DyPrIs improvements: The system now treats long-lived and I/O-heavy workloads as high-risk cases, with detection occurring during execution rather than post-invocation. Cloudflare is also exploring remote timing patterns as an additional behavioral signal.

What to watch

The research highlights that Spectre defenses remain an arms race. While the V8 Sandbox and MPK mitigate this specific attack, the paper notes that other Spectre variants or gadgets may still pose risks. Cloudflare’s ongoing work includes refining DyPrIs to detect remote timing patterns and hardening the Workers runtime against future speculative execution exploits. The company continues to encourage bug bounty submissions targeting memory safety in its runtime.