#atop — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #atop, aggregated by home.social.
-
CVE Alert: CVE-2026-3823 - Atop Technologies - EHG2408 - https://www.redpacketsecurity.com/cve-alert-cve-2026-3823-atop-technologies-ehg2408/
#OSINT #ThreatIntel #CyberSecurity #cve-2026-3823 #atop-technologies #ehg2408
-
The updated news is that atopgpud's TCP service, that I mentioned, is indeed one problem.
https://github.com/Atoptool/atop/issues/334
It does beg the question of why it uses TCP at all, when an AF_LOCAL socket in /run/atop/ or something is more in line with its other data-collection service.
-
Far from the only problem with atopgpud.
-
However, note that someone else has run xyr own code checker on atop in the meantime and claims to have found a problem nonetheless.
-
I saw it, and I agree with people's response to "This is not the way to do this.", which was: "Then why did you do it that way, then?"
-
There's a whole bunch of dodgy stuff, from atopgpud to code that assumes that it can blat a NUL and then call strcpy().
See thread at
https://social.chatty.monster/@losttourist/114229385233902820 -
People who wrote their system tools with safe string libraries such as DJB's, skalibs, or even just C++'s std::string automatically suspect such tries-to-be-clever-with-NULs code.
At the bare minimum, tag the SPC onto the destination buffer & don't touch the (possibly only 1) NUL-terminated source buffer. But better yet, don't do it that way at all.
But there are so many other poor practices in that software, including the aforementioned atopgpud TCP server.
-
These things when undisclosed are usually almost never reflected in GitHub.
I looked at the code yesterday, and, from inspection only, my suspicion immediately landed on photoproc.c .
There's some dodgy C trickery going on there that I wouldn't put past having some edge cases.
Assuming (wrongly) that a string is doubly-NUL terminated (not guaranteed by getdelim()), blatting the first NUL with a SPC and then calling strcpy() is just one such suspect case.
-
-
There are a lot of potential vulnerability loci.
It could even be a privacy thing. Arch users get the whole package, which includes an atopgpud that sends GPU statistics over TCP out to anyone who asks, and has no connection limiting or transaction timeout capabilities. (This isn't packaged in Debian.)
-
My educated guess is the kernel module or the dæmon having some serious problem. The command-line tool isn't set-UID, as far as I can see. (I'm just going off the package install recipes. I don't have it installed.)
-
@catsalad @puppygirlhornypost2 @Emily
Also note that there are different #atop packages around.
-
Might be excessive.
The #atop used in #FreeBSD is a different one to the one used by Linux distributions (& #NetBSD/#OpenBSD have no atop in ports/packages at all).
FreeBSD sysutils/atop in the ports tree uses a FreeBSD codebase maintained by Alex Samorukov. It has no kernel module/atopacctd.
https://freshports.org/sysutils/atop/
https://github.com/samm-git/atop-freebsd
Arch/Debian instead track Gerlof Langeveld's atoptool, which has a kernel module/BPF hooks & an atopacctd.
-
-
-
You might want to stop running atop
https://rachelbythebay.com/w/2025/03/25/atop/
#HackerNews #You #might #want #to #stop #running #atop #HackerNews #TechNews #WebDevelopment #SoftwareEngineering #Programming
-
@nixCraft I don't. But I do love atop or, as I like to call it, the ultimate consultant tool…
-
In praise of... #atop
There's a tonne of monitoring tools for *nix. Although the more top(1)-esque tools such as bottom, htop, etc., aren't comparable to atop(1).
atop is written by JC Van Winkel and offers monitoring like no other tool can. It has the ability to sample its output so that you can read it back in later, such as:
atop -w atop-output.log -i 10
Which will sample every ten seconds.
Reading this back in after a time can be done with:
atop -r atop-output.log
With the atopacctd(1) command, sample log files are written out periodically so you can analyse what the system was doing at a point in time.
There's also a graph mode, with:
atop -BH
Which I use all the time.
Screenshots attached.
I really think this is worth trying out -- this small summary here doesn't cover 0.0000001% of what atop can do.
