Cloudflare disclosed its memory leak on February 23, 2017. Its retained incident report describes an error in an older HTML parser, software that reads the structure of web pages. The newer parser changed the way blocks of data passed through the system. Cloudflare said that change exposed an existing defect rather than introducing a defect in the new parser itself. [cf]
A buffer is a bounded block of memory. According to the operator, a pointer tracking the current reading position could move beyond that block while handling malformed HTML. The stopping test looked for equality with the boundary. Once the pointer had skipped past it, equality no longer held, so processing could continue outside the intended data. The failure was in checking where reading should stop. [cf]
Cloudflare assigned responsibility to its own use of Ragel, the tool used to generate parser code, rather than to Ragel itself. Earlier buffering arrangements had kept the defect from producing this disclosure, the company said. The causal distinction matters: the old code contained the error; the interaction with changed buffering made it observable. These are details from an updated operator account, not an independently reproduced experiment. [cf]
Bitsight described the resulting disclosure in its February 24 analysis: malformed pages could cause memory contents to appear in web output. It also explained why encrypted connections did not settle the issue, since Cloudflare terminated those connections to process customer traffic. Read together, the accounts describe a memory-handling failure during web processing, not evidence that the underlying encryption mathematics had been broken. [bitsight][cf]
Source documents
- Last Friday,https://blog.cloudflare.com/incident-report-on-memory-leak-caused-by-cloudflare-parser-bug/
- Cloudbleed: Breakdown of Cloudflare's Memory Leakhttps://www.bitsight.com/blog/cloudbleed-breakdown-of-cloudflares-memory-leak