a suspicious process named 'kdevtmpfsi'，likely related to redis offical image 'redis:4-alpine' in docker hub

[biello]

I notice that there is a kdevtmpfsi executable file under my redis:4-alpine container fs /tmp and a process named 'kdevtmpfsi' cost about 400% cpu, when i remove redis container and run again the file is gone. is this normal? seems like being hijacked to mine cryptocurrency or something.

[iamareebjamal]

Remove the added cron and /tmp/zzz.sh kdevtmpfsi and search kinsing and delete every folder containing those processes. Now kill the process and restart

[wglambert]

Yeah that file isn't supposed to be there
A search query for that filename says it's malicious

#140 (comment)

As noted by the creator of redis; it is very easy to "hack" a redis server and change files: http://antirez.com/news/96.

I successfully gained access as the Redis user, with a proper shell, in like five seconds. Courtesy of a Redis instance unprotected being, basically, an on-demand-write-this-file server, and in this case, by ssh not being conservative enough to deny access to a file which is all composed of corrupted keys but for one single entry. However ssh is not the problem here, once you can write files, even with binary garbage inside, it’s a matter of time and you’ll gain access to the system in one way or the other.

We do not build images with malware installed (I did just pull and check them in case there was some sort of exploit of Docker Hub). The affected users are likely exposing their redis to the public internet where it is trivial to "hack".

Edit: previous users with problems by "hackers", #44 (comment), #44 (comment), #44 (comment)

[iamareebjamal]

This is not a redis issue. This is a known crypto mining malware unrelated to redis

[tianon]

See also docker-library/docs#1571 where this was officially documented.

Also, just to be fully explicit:

$ docker pull redis:4-alpine
4-alpine: Pulling from library/redis
Digest: sha256:cc33d01d0c96e498284886d2afc0a5d09250334efd61dd430e5edce9b89a9a3c
Status: Image is up to date for redis:4-alpine
docker.io/library/redis:4-alpine

$ docker run --rm redis:4-alpine find / -iname kdevtmpfsi
$ 

[andrerfneves]

@iamareebjamal happen to have any more info/links on that? Can't seem to find anything

[iamareebjamal]

https://r.virscan.org/report/07256aabf45b690a8a3989d0efa38e18
https://stackoverflow.com/questions/59487096/kdevtmpfsi-how-to-find-and-delete-that-miner
https://forums.unraid.net/topic/86241-help-cpu-goes-to-100-all-cores/
linuxserver/docker-nextcloud#125
laradock/laradock#2451
Gerapy/Gerapy#130

[andrerfneves]

thanks!

[derakhshanfar]

Guys the same issue for me. do you have any workaround?

[iamareebjamal]

Remove /tmp/kdevtmpfsi, /tmp/zzz and /var/tmp/ executables and replace with blank files with no permissions, then the miner cannot readd the files, then kill the running process

[iamareebjamal]

Or follow this - laradock/laradock#2451 (comment)

[derakhshanfar]

@iamareebjamal A big thank you to you . I did something like this:

touch /tmp/kdevtmpfsi && touch /var/tmp/kinsing
echo "everything is good here" > /tmp/kdevtmpfsi
echo "everything is good here" > /var/tmp/kinsing
cat /tmp/kdevtmpfsi && cat /var/tmp/kinsing

chmod go-rwx /var/tmp
chmod 1777 /tmp

but after a couple of mitues it started again !