Cloudflare Sandboxes

A cross-tenant data exposure flaw in Cloudflare's Containers and Sandboxes has been disclosed and fixed. The issue stemmed from dm-thin storage pools running with skip_block_zeroing enabled, meaning newly written 4 KiB pages into unmapped 64 KiB blocks could leave residual data on raw devices. A Workers Paid tenant could reportedly read up to 60 KiB of data left behind by a previous tenant from /dev/vdc. Cloudflare has patched the issue, and security communities are discussing the implications of shared-storage isolation failures in multi-tenant cloud platforms.