Why kthreaddi is consuming 100% CPU in debian (Docker container) AWS ECS

user_6489283 0
Viewed 723

I am runnign my tomcat application on AWS ECS, I am facing issue when sudeen my CPU touch 100% after executing htop command i found that one process kthreaddi is utilizing all the CPU as in screenshot.

Screenshot kthreaddi

I tried few aporoach like apt-get update during image creation but issue is still coming.

Can anyone suggest what i can implement here.

Here is output of cat /etc/os-release

PRETTY_NAME="Debian GNU/Linux 10 (buster)"
NAME="Debian GNU/Linux"
VERSION_ID="10"
VERSION="10 (buster)"
VERSION_CODENAME=buster
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"
amazon-ecs docker amazon-web-services debian linux
1 Answers

I found that kthreaddi is a virus that pretends to look like kthreadd which in actuality a process use to manage os resource.

It comes in my server via one of my application vulnerabilities via which attackers can do bit mining and can harm client data as well.

As mentioned in the link -

https://www.programmersought.com/article/54487928634/

How to Fix it:

1- Make sure you are not running the application via a root user, the root user provides the power to attacker by which he can install crontab and another scripting tool that provide support in attack.

2- Make sure temp directory can not access by other users only root can access chmod 760 /tmp

3- make sure your file system is secure and can access by only application users, in my case, I am using EFS and only uid 1000 can access it.

4- Check your os is with the latest security updates

user_64892830
Related