CVE-2025-31160 Atop 2.11版堆问题

CVE-2025-31160 Atop 2.11版堆问题
Atop 2.11 heap problems

原始链接: https://openwall.com/lists/oss-security/2025/03/29/1

Atop 2.4.0 及更高版本中发现了一个漏洞，CVE-2025-31160，该漏洞与 Atop 处理来自可选外部资源（例如 'atopgpud'）的数据的方式有关。Atop 在初始化期间会自动尝试连接到 'atopgpud' 的 TCP 端口。如果恶意程序或意外程序占用该端口，Atop 可能会收到意外字符串，从而导致解析失败、堆损坏和段错误。主要的修复方法是更改 Atop 的默认行为。除非用户使用 `-k` 标志明确指示，否则它将不再自动连接到 'atopgpud' 端口。使用 `-k` 时，字符串解析得到改进以防止堆问题。类似地，'netatop' 或 'netatop-bpf' 的自动检测默认情况下也被禁用，只有在使用 `-K` 标志时才会启用，因为这些是可选资源。这些更改减轻了 Atop 与意外程序交互并触发漏洞的风险。

Atop 2.11版本中发现了一个新的漏洞，CVE-2025-31160，该漏洞与堆问题有关。Hacker News的讨论链接指向了之前关于Atop稳定性的担忧。初步反应表明，该漏洞的严重性低于预期，需要启用可选功能才能被利用。然而，一些用户澄清说，虽然守护进程是可选的，但Atop总是尝试本地连接，这可能使其默认情况下容易受到攻击。攻击者可以在预期端口上运行恶意程序，并发送精心构造的字符串以触发溢出。目前讨论中的修复方案是使有问题的功能可选，尽管存在最初的担忧，但这仍然被认为是一种改进。

Nvtop：适用于 Nvidia、AMD 和 Intel GPU 的 Linux 任务监视器 2024-03-14

（评论） 2024-03-27

MongoDB 安全公告 2023-12-18

堆溢出 Llama.cpp 实现远程代码执行 2025-03-26

原文

oss-security - CVE-2025-31160 Atop 2.11 heap problems [<prev] [<thread-prev] [day] [month] [year] [list]

Message-ID: <[email protected]>
Date: Sat, 29 Mar 2025 18:39:29 +0100
From: Gerlof Langeveld <[email protected]>
To: [email protected]
Subject: CVE-2025-31160 Atop 2.11 heap problems

Introduction:
Atop mainly reads the system level and process level from the /proc and
/sys directories. However, certain counters might be obtained from other
optional sources, that have to be activated explicitly.

One of these sources is the 'atopgpud' daemon, which permanently gathers
metrics about the utilization of GPUs. It offers a local TCP port to which
atop can connect to retrieve GPU-related counters. These counters are
provided as strings that have to be parsed by atop.

Vulnerability:
The vulnerability is caused by the fact that atop always tries to connect
to the TCP port of 'atopgpud' during initialization. When another local
program has been started (instead of 'atopgpud') that listens to this TCP
port, atop connects to that program. Such program is able then to send
unexpected strings that may lead to parsing failures in atop. These failures
result in heap problems and segmentation faults.

Although no additional information has been received about these heap
problems, the described heap problems were reproduced with a custom
developed test program.

The vulnerability is present since the introduction of 'atopgpud'
in atop 2.4.0.

Solution:
1) Most systems will not explicitly activate the 'atopgpud' daemon.
    Therefore, the default behavior of atop is now not to connect to the TCP
    port at all. Only when atop is started with the '-k' flag it will try to
    connect to the TCP port (in case you know that 'atopgpud' is running).

2) When the '-k' flag is used, the parsing of the strings is improved to
    avoid that heap problems can occur.

3) Another optional source for atop might be 'netatop' or 'netatop-bpf'.
    Since most systems will not explicitly install/use these sources, 
the default
    behavior of atop is now not to try to find these sources. Only when 
atop is
    started with the '-K' flag it will try to find 'netatop' or 
'netatop-bpf'.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.

CVE-2025-31160 Atop 2.11版堆问题 Atop 2.11 heap problems

CVE-2025-31160 Atop 2.11版堆问题
Atop 2.11 heap problems