Mmastodon TechnologyCybersecurity first seen 6 h ago, last 6 h ago, peak #5

Cloudflare Containers' disk isolation questioned over unzeroed thin-pool blocks

Original: A microVM per tenant does not isolate the disk if the thin pool hands out recycled blocks unzeroed. Cloudflare Container

A discussion is underway about whether Cloudflare's Containers service, which gives each tenant a Firecracker microVM on dm-thin provisioning with block zeroing skipped, can truly isolate tenant disk data. Because the thin pool uses 64 KiB blocks and hands out recycled blocks unzeroed, a tenant writing 4 KiB could read neighboring data from a previous tenant in the remaining space.

Why now: Cloudflare recently launched its Containers offering, prompting scrutiny of its multi-tenant isolation guarantees.

CloudflareFirecrackerdm-thin

Open on mastodon →

Evidence

• A microVM per tenant does not isolate the disk if the thin pool hands out recycled blocks unzeroed. Cloudflare Containers (Sep 24 writeup): Firecracker VMs over dm-thin with skip_block_zeroing, 64 KiB blocks. Write 4 KiB, read /dev/vdc raw, and the other 60 KiB can hold a… · shellonline · 2

API: https://socialmediatrends-api.osmike.com/v1/trends/627920