Embed Notice

HTML Code

<blockquote style="position: relative; padding-left: 55px;"><section><a href="https://cofe.rocks/objects/836c7b5a-a3f3-4ea0-a936-1c25d8a6e589">snow :bot: (collector's edition ✨) (snow@cofe.rocks)'s status on Sunday, 30-Mar-2025 04:22:00 JST</a><a href="https://cofe.rocks/users/snow" title="snow@cofe.rocks"><img src="https://gnusocial.jp/avatar/246887-48-20240417180415.webp" width="48" height="48" alt="snow :bot: (collector's edition ✨)" style="position: absolute; left: 0; top: 0;">snow :bot: (collector's edition ✨)</a></section><article>extremely boring conclusion to the ominous atop issue that rachel made orangesite freak out about with her "i'm under nda" style post:<br><br>atop tried to connect via tcp to atopgpud by default for gathering gpu metrics, and if sth else was listening there it could feed it garbage<br>atopgpud conns are now off by default<br><br><a href="https://www.openwall.com/lists/oss-security/2025/03/29/1">https://www.openwall.com/lists/oss-security/2025/03/29/1</a><br><a href="https://github.com/Atoptool/atop/commit/542b7f7ac52926ca272129dba81d7db80279bb98">https://github.com/Atoptool/atop/commit/542b7f7ac52926ca272129dba81d7db80279bb98</a></article><footer><a rel="bookmark" href="https://gnusocial.jp/conversation/4813678#notice-9429028">In conversation</a><time datetime="2025-03-30T04:22:00+09:00" title="Sunday, 30-Mar-2025 04:22:00 JST">about 6 days ago</time> <span>from <span><a href="https://cofe.rocks/objects/836c7b5a-a3f3-4ea0-a936-1c25d8a6e589" rel="external" title="Sent from cofe.rocks via ActivityPub">cofe.rocks</a></span></span><a href="https://cofe.rocks/objects/836c7b5a-a3f3-4ea0-a936-1c25d8a6e589">permalink</a><h4>Attachments</h4><ol><li><article><header><div>Domain not in remote thumbnail source whitelist: www.openwall.com</div><h5><a href="https://www.openwall.com/lists/oss-security/2025/03/29/1">oss-security - CVE-2025-31160 Atop 2.11 heap problems</a></h5><div></div></header><div></div><footer></footer></article></li><li><article><header><div>Domain not in remote thumbnail source whitelist: opengraph.githubassets.com</div><h5><a href="https://github.com/Atoptool/atop/commit/542b7f7ac52926ca272129dba81d7db80279bb98">Fix security vulnerability CVE-2025-31160 (#334) · Atoptool/atop@542b7f7</a></h5><div></div></header><div>Atop will not connect to the TCP port of 'atopgpud' daemon any more
by default.  The flag -k can be used explicitly when 'atopgpud' is
active. Also the code to parse the received st...</div><footer></footer></article></li></ol></footer></blockquote>

Corresponding Notice

Embed this notice
snow :bot: (collector's edition ✨) (snow@cofe.rocks)'s status on Sunday, 30-Mar-2025 04:22:00 JST snow :bot: (collector's edition ✨)
extremely boring conclusion to the ominous atop issue that rachel made orangesite freak out about with her "i'm under nda" style post:

atop tried to connect via tcp to atopgpud by default for gathering gpu metrics, and if sth else was listening there it could feed it garbage
atopgpud conns are now off by default

https://www.openwall.com/lists/oss-security/2025/03/29/1
https://github.com/Atoptool/atop/commit/542b7f7ac52926ca272129dba81d7db80279bb98
In conversationabout 6 days ago from cofe.rockspermalink
Attachments
1. Domain not in remote thumbnail source whitelist: www.openwall.com
  oss-security - CVE-2025-31160 Atop 2.11 heap problems
2. Domain not in remote thumbnail source whitelist: opengraph.githubassets.com
  Fix security vulnerability CVE-2025-31160 (#334) · Atoptool/atop@542b7f7
  Atop will not connect to the TCP port of 'atopgpud' daemon any more by default. The flag -k can be used explicitly when 'atopgpud' is active. Also the code to parse the received st...

Public

Embed Notice

HTML Code

Corresponding Notice