<story><title>Cloudflare Reverse Proxies Are Dumping Uninitialized Memory</title><url>https://bugs.chromium.org/p/project-zero/issues/detail?id=1139</url></story><parent_chain><item><author>amalcon</author><text>Some old IBM environments initialized fresh allocations to 0xDEADBEEF, which had the advantage that the result you got from using such memory would (usually) be obviously incorrect.  The fact that it was done decades ago is pretty good evidence that it&amp;#x27;s not about the actual initialization cost:  these things cost a lot more back then.&lt;p&gt;What changed is the paged memory model:  modern systems don&amp;#x27;t actually tie an address to a page of physical RAM until the first time you try to use it (or something else on that page).  Initializing the memory on malloc() would &amp;quot;waste&amp;quot; memory in some cases, where the allocation spans multiple pages and you don&amp;#x27;t end up using the whole thing.  Some software assumes this, and would use quite a bit of extra RAM if malloc() automatically wiped memory.  It would also tend to chew through your CPU cache, which mattered less in the past because any nontrivial operation already did that.&lt;p&gt;I personally don&amp;#x27;t think this is a good enough reason, but it is a little more than just a minor performance issue.&lt;p&gt;That all being said, while it would likely have helped slightly in this case, it would not solve the problem:  active allocations would still be revealed.</text></item><item><author>infinity0</author><text> Could someone enlighten me on why malloc and free don&amp;#x27;t automatically zero memory by default?&lt;p&gt;Someone pointed me to MALLOC_PERTURB_ and I&amp;#x27;ve just run a few test programs with it set - including a stage1 GCC compile, which granted may not be the best test - and it really doesn&amp;#x27;t dent performance by much. (edit: noticeably, &lt;i&gt;at all&lt;/i&gt;, in fact)&lt;p&gt;People who prefer extreme performance over prudent security should be the ones forced to mess about with extra settings, anyway.</text></item><item><author>PuffinBlue</author><text>&amp;gt; The infosec team worked to identify URIs in search engine caches that had leaked memory and get them purged. With the help of Google, Yahoo, Bing and others, we found 770 unique URIs that had been cached and which contained leaked memory. Those 770 unique URIs covered 161 unique domains. The leaked memory has been purged with the help of the search engines.&lt;p&gt;So I tried it too, and there&amp;#x27;s still data cached there.&lt;p&gt;Am I misunderstanding something - that above statement must be wrong, surely?&lt;p&gt;They can&amp;#x27;t have found everything even in the big search engines if it&amp;#x27;s still showing up in Google&amp;#x27;s cache, let alone the infinity other caches around the place.&lt;p&gt;EDIT: If the cloudflare team sees I see leaked credentials for these domains:&lt;p&gt;android-cdn-api.fitbit.com&lt;p&gt;iphone-cdn-client.fitbit.com&lt;p&gt;api-v2launch.trakt.tv</text></item><item><author>espadrine</author><text>It is far from over, too! Google Cache still has loads of sensitive information, a link away!&lt;p&gt;Look at this, click on the downward arrow, &amp;quot;Cached&amp;quot;: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.google.com&amp;#x2F;search?q=&amp;quot;CF-Host-Origin-IP:&amp;quot;+&amp;quot;authorization:&amp;quot;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.google.com&amp;#x2F;search?q=&amp;quot;CF-Host-Origin-IP:&amp;quot;+&amp;quot;author...&lt;/a&gt;&lt;p&gt;(And then, in Google Cache, &amp;quot;view source&amp;quot;, search for &amp;quot;authorization&amp;quot;.)&lt;p&gt;(Various combinations of HTTP headers to search for yield more results.)</text></item><item><author>tptacek</author><text>Oh, my god.&lt;p&gt;Read the whole event log.&lt;p&gt;If you were behind Cloudflare and it was proxying sensitive data (the contents of HTTP POSTs, &amp;amp;c), they&amp;#x27;ve potentially been spraying it into caches all across the Internet; it was so bad that Tavis found it by accident just looking through Google search results.&lt;p&gt;The crazy thing here is that the Project Zero people were joking last night about a disclosure that was going to keep everyone at work late today. And, this morning, Google announced the SHA-1 collision, which everyone (including the insiders who leaked that the SHA-1 collision was coming) thought was the big announcement.&lt;p&gt;Nope. A SHA-1 collision, it turns out, is the &lt;i&gt;minor&lt;/i&gt; security news of the day.&lt;p&gt;This is approximately as bad as it ever gets. A significant number of companies probably need to compose customer notifications; it&amp;#x27;s, at this point, very difficult to rule out unauthorized disclosure of anything that traversed Cloudflare.</text></item></parent_chain><comment><author>masklinn</author><text>&amp;gt; Some old IBM environments initialized fresh allocations to 0xDEADBEEF, which had the advantage that the result you got from using such memory would (usually) be obviously incorrect.&lt;p&gt;On BSDs, malloc.conf can still be configured to do that: on OpenBSD, junking (fills allocations with 0xdb and deallocations with 0xdf) is enabled by default on small allocations, &amp;quot;J&amp;quot; will enable it for all allocations. On FreeBSD, &amp;quot;J&amp;quot; will initialise all allocations with 0xa5 and deallocations with 0x5a.</text></comment>
<story><title>Cloudflare Reverse Proxies Are Dumping Uninitialized Memory</title><url>https://bugs.chromium.org/p/project-zero/issues/detail?id=1139</url></story><parent_chain><item><author>amalcon</author><text>Some old IBM environments initialized fresh allocations to 0xDEADBEEF, which had the advantage that the result you got from using such memory would (usually) be obviously incorrect.  The fact that it was done decades ago is pretty good evidence that it&amp;#x27;s not about the actual initialization cost:  these things cost a lot more back then.&lt;p&gt;What changed is the paged memory model:  modern systems don&amp;#x27;t actually tie an address to a page of physical RAM until the first time you try to use it (or something else on that page).  Initializing the memory on malloc() would &amp;quot;waste&amp;quot; memory in some cases, where the allocation spans multiple pages and you don&amp;#x27;t end up using the whole thing.  Some software assumes this, and would use quite a bit of extra RAM if malloc() automatically wiped memory.  It would also tend to chew through your CPU cache, which mattered less in the past because any nontrivial operation already did that.&lt;p&gt;I personally don&amp;#x27;t think this is a good enough reason, but it is a little more than just a minor performance issue.&lt;p&gt;That all being said, while it would likely have helped slightly in this case, it would not solve the problem:  active allocations would still be revealed.</text></item><item><author>infinity0</author><text> Could someone enlighten me on why malloc and free don&amp;#x27;t automatically zero memory by default?&lt;p&gt;Someone pointed me to MALLOC_PERTURB_ and I&amp;#x27;ve just run a few test programs with it set - including a stage1 GCC compile, which granted may not be the best test - and it really doesn&amp;#x27;t dent performance by much. (edit: noticeably, &lt;i&gt;at all&lt;/i&gt;, in fact)&lt;p&gt;People who prefer extreme performance over prudent security should be the ones forced to mess about with extra settings, anyway.</text></item><item><author>PuffinBlue</author><text>&amp;gt; The infosec team worked to identify URIs in search engine caches that had leaked memory and get them purged. With the help of Google, Yahoo, Bing and others, we found 770 unique URIs that had been cached and which contained leaked memory. Those 770 unique URIs covered 161 unique domains. The leaked memory has been purged with the help of the search engines.&lt;p&gt;So I tried it too, and there&amp;#x27;s still data cached there.&lt;p&gt;Am I misunderstanding something - that above statement must be wrong, surely?&lt;p&gt;They can&amp;#x27;t have found everything even in the big search engines if it&amp;#x27;s still showing up in Google&amp;#x27;s cache, let alone the infinity other caches around the place.&lt;p&gt;EDIT: If the cloudflare team sees I see leaked credentials for these domains:&lt;p&gt;android-cdn-api.fitbit.com&lt;p&gt;iphone-cdn-client.fitbit.com&lt;p&gt;api-v2launch.trakt.tv</text></item><item><author>espadrine</author><text>It is far from over, too! Google Cache still has loads of sensitive information, a link away!&lt;p&gt;Look at this, click on the downward arrow, &amp;quot;Cached&amp;quot;: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.google.com&amp;#x2F;search?q=&amp;quot;CF-Host-Origin-IP:&amp;quot;+&amp;quot;authorization:&amp;quot;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.google.com&amp;#x2F;search?q=&amp;quot;CF-Host-Origin-IP:&amp;quot;+&amp;quot;author...&lt;/a&gt;&lt;p&gt;(And then, in Google Cache, &amp;quot;view source&amp;quot;, search for &amp;quot;authorization&amp;quot;.)&lt;p&gt;(Various combinations of HTTP headers to search for yield more results.)</text></item><item><author>tptacek</author><text>Oh, my god.&lt;p&gt;Read the whole event log.&lt;p&gt;If you were behind Cloudflare and it was proxying sensitive data (the contents of HTTP POSTs, &amp;amp;c), they&amp;#x27;ve potentially been spraying it into caches all across the Internet; it was so bad that Tavis found it by accident just looking through Google search results.&lt;p&gt;The crazy thing here is that the Project Zero people were joking last night about a disclosure that was going to keep everyone at work late today. And, this morning, Google announced the SHA-1 collision, which everyone (including the insiders who leaked that the SHA-1 collision was coming) thought was the big announcement.&lt;p&gt;Nope. A SHA-1 collision, it turns out, is the &lt;i&gt;minor&lt;/i&gt; security news of the day.&lt;p&gt;This is approximately as bad as it ever gets. A significant number of companies probably need to compose customer notifications; it&amp;#x27;s, at this point, very difficult to rule out unauthorized disclosure of anything that traversed Cloudflare.</text></item></parent_chain><comment><author>magnetic</author><text>&amp;gt; What changed is the paged memory model: modern systems don&amp;#x27;t actually tie an address to a page of physical RAM until the first time you try to use it (or something else on that page). Initializing the memory on malloc() would &amp;quot;waste&amp;quot; memory in some cases, where the allocation spans multiple pages and you don&amp;#x27;t end up using the whole thing. Some software assumes this, and would use quite a bit of extra RAM if malloc() automatically wiped memory. It would also tend to chew through your CPU cache, which mattered less in the past because any nontrivial operation already did that.&lt;p&gt;Maybe an alternative approach is to simply mark the pages to be lazily zeroed out when attached, in the Page Table Entries of the MMU. They wouldn&amp;#x27;t be zeroed out at the time of the call malloc(), but only when they are attached to a physical memory location (the first time you use it).</text></comment>