Software Engineering Institute

A buffer overflow in gtopd, specifically permitted(), may allow a remote attacker to execute arbitrary code. For more detailed information, please see Flavio Veloso's analysis.

gtop background information

Many Unix systems allow only privileged processes to access information about other running processes. For example, an unprivileged process will typically not have the ability to acquire details regarding the memory or CPU usage of another process. As a result of these limitations, system utilities like uptime or top are frequently setuid root or setgid kmem. This makes it difficult to write a graphical system utility like cpumemusage or gtop because making a GTK+ program setgid or setuid would introduce additional security risks. The gtop daemon was designed to access this type of privileged information and disseminate it to the unprivileged applications requesting privileged data such as memory and CPU usage. Therefore, gtop is a setgid/setuid server designed to run on a host and gather privileged information and pass it to GUI clients.

A remote attacker may be able to execute arbitrary code with elevated privileges. Depending on the particular way gtop is built and implemented, it may also be possible for an attacker to read kernel memory. The ability to read kernel data is particularly dangerous because there is often sensitive data such as terminal activity, network traffic, and other types of privileged information residing in kernel memory space. Because of this, it may be possible for an attacker to leverage this vulnerability to gain root access to the local system, and possibly other systems interacting with the host running the gtop daemon.

Apply a patch from your vendor.