Re: atop: Heap corruption

[Solar Designer <solar () openwall com>]

On Wed, Mar 26, 2025 at 08:12:32PM -0400, Thomas Ward wrote:
> On 2025-03-26 19:56, Alan Coopersmith wrote:
> > On 3/26/25 16:07, Solar Designer wrote:
> > > https://rachelbythebay.com/w/2025/03/26/atop/
> >
> > CVE-2025-31160 appears to have been issued by Mitre to track this:
> >
> > https://www.cve.org/CVERecord?id=CVE-2025-31160
> >
> > but only listing the above blog and the ycombinator threads for details.
>
> ... this should include a link to 
> https://github.com/Atoptool/atop/issues/330 which is a tracker for the 
> issue in this CVE.

No, it should not, and no, it is not.  Just because people started
adding comments to this random issue doesn't make it the issue.

The specific bug that #330 is about is clear and is already fixed, but
the heap corruption is neither investigated nor fixed.

> It looks like a munmap patch has been provided but 
> it looks also that this may be one of multiple 'suspicious' commits on 
> the radar (if you read the issue thread).

This kind of suspicion to irrelevant recent commits is what I meant by:

"Some people on various forums are now looking at recent atop commits
but none appear relevant - indeed, the above doesn't look like it was
investigated nor reported properly, so there isn't expected to be a fix
in the repo yet."

Rachel's original blog post yesterday didn't say it was heap corruption
(she clarified this in the followup today), which is why people also
started suspecting backdoors, etc.  The extra scrutiny is great, but
none of the pre-existing commits or GitHub issues are likely relevant.

Alexander