Embed Notice

@0xabad1dea

Summary of the HN discussion so far

• I trust Rachel and I am uninstalling
• Use btop
• Is that installed anywhere by default?
• Why is she so vague?

and https://news.ycombinator.com/item?id=43478866, https://github.com/Atoptool/atop/blame/037a6d3e4ace6c7be6c5dcf0c286c013e3c884cc/rawlog.c#L554-L556, 14 years ago, which I would not less pass in a code review today.

This ends up being a call to execl() to a binary without a path, and a sh with interpolation inbetween. It should be a call to execve() with a clean env, and a path to a binary, sans sh.

If this is run as root in a suid binary, it would be not good.