You might want to stop running atop

There's a lot of speculation about why, with the answer almost certainly security / exploitable (or backdoor), and I'll just throw an extra little tidbit in:

atop seems to run persistently as root, which may be the reason for preventing it from running/uninstalling.

the netatop part of atop installs a persistent kernel module, netatop.ko, as part of its installation. The module hooks netfilter to be able to monitor all traffic.

If there's an exploitable flaw in the kernel module, this would be a max-severity CVE.

netatop _also_ runs a persistent daemon, netatopd, which I believe from inspecting the source runs as root.

The article's language about uninstalling it kinda sorta makes you think one of these three parts is in some way exploitable or backdoored -- any which way it's a privileged process, and one that's monitoring network traffic.

(I'm not sure if netatop is installed by default on systems when you install atop, per czk's comment below)

I vaguely remember an old bug in atop, leading to a very unusual consequence.

Atop will do an invalid memory write and crash with a segfault. But this writing is performed on a memory page mapped to a hardware timer. Despite not being able to write into that page, just touching it somehow changes how this hardware timer works. Then, the OS detects that this timer is inaccurate and switches to a different clock source (which you can see in /sys/devices/system/clocksource/clocksource0/current_clocksource). As a result, every call to clock_gettime becomes slower, and the system becomes slower as a whole until it restarts.

In short, a segfault in atop leads to the whole system's performance degradation. But this was found around maybe 7 years ago.

Rachel has posted a follow-up:

https://rachelbythebay.com/w/2025/03/26/atop/

> user1 does something... and gets user2 to blow up. If you can make that do something useful, then you get user2 to run stuff on your behalf.

This screams NDA/disclosure but things are so mega super fucked that they feel obligated to pre warn as early as possible.

I wonder how long/old the problem is in atop?

At a previous gig, atop was running fleet-wide (> 1k servers) as sort of a resource monitoring tool of last resort, in a similar way as is described in this article[0]. I left a few years ago, but if memory serves, this thing was baked into base-image Puppet configs, and proved itself handy in past investigations of hard-to-find problems. If this turns to be real threat, I wouldn't be surprised if the blast radius for this is substantial.

[0]: https://www.bodhost.com/kb/how-to-monitor-system-resource-us...

No one else seems to have run 'grep system(', so I will:

https://github.com/Atoptool/atop/blob/037a6d3e4ace6c7be6c5dc...

> system ("gunzip -c %s > %s", tmpname1, tmpname2")

tmpname2 is hardcoded as "/tmp/atopwrkXXXXXX", so that's fine. tmpname1 is '$irawname.gz'. '$irawname' is set by the '-r' flag.

So, presumably if you can get the rest of the code to play nice and get you there, you can escalate from having shell access to run atop, to having shell access. Oh, I guess that's nothing.

Anyway, still a really bad use of system + user-controlled input, don't do that.

It's Rachel. If she says to remove it, I'll remove it. I see people are suspicious, but I think I'll trust someone like her at least once to do this.

There's a bunch of interesting recent commits from someone without a public signing key.

    Removed excess checks before free()
    Fixed possible wrong result bit shifting on 64bit after left op type overflow
    Fixed possible wrong result bit shifting on 64bit after left operand type overflow
    Fixed possible access out-of-bounds items array better check index before using

I recently had a course from the author of atop. Seemed like a straight up FOSS friendly guy, I’ll forward him this page.

I stopped using atop when I found it installs several hooks which automatically run code as root and deposit files around the filesystem, including a "power management" hook.

Pure speculation; but it sounds to me like she was doing some sysadmin triage and possibly stumbled onto a backdoor/exfiltration through atop.

She likely can't disclose anything right now.

Is atop included in any distributions?

Is there even a tool to search what is pre-installed in each major distribution(s)?