How Cloudflare addressed a cross-tenant data exposure vulnerability in Containers

This post details a cross-tenant data exposure vulnerability in Cloudflare Containers and Sandboxes related to Linux device mapper thin provisioning and the `skip_block_zeroing` option. It explains how residual disk blocks could be recovered by a tenant with a Workers Paid account. The post outlines the exploit mechanism, the validation process using ext4 directory block checksums, and the mitigation steps taken: removing `skip_block_zeroing` from the `dm-thin` pool configuration and clearing old pool data and cached image snapshots. It also confirms no evidence of malicious exploitation beyond authorized validation.