repeatatively creating sync_super for www-data which is showing high CPU usage

Question

I am facing same kind of problem of having sync_supers recreated on my server, which are using high CPU usage:

4353 www-data 20 0 24392 3888 1012 R 100.0 0.0 13:15.26 [sync_supers]
5268 www-data 20 0 24392 3888 1012 R 100.0 0.0 9:42.56 [sync_supers]
4344 www-data 20 0 24264 3744 876 R 99.7 0.0 70:22.26 [sync_supers]
6792 www-data 20 0 24392 3892 1012 R 85.5 0.0 7:16.08 [sync_supers]

I have deleted few but again recreated with different pid.

Please help. I am not expertised in Ubuntu and linux, so bit difficult to trace the issue.

Thank you very much.

Answer 1

It's probably malware. sync_supers was a kernel thread, which should never be running as www-data, and hardly using any resources. And it should not be in use on a 16.04-system.

So check your backup for malware, and nuke the machine, and reinstall from backups that you have verified is clean. A compromised system should probably not be trusted ever again, as it is difficult to find all backdoors that may have been left there.

Answer 2

I just answered this on stackoverflow but since it is not the place I will just let it here: this just happened to me and the answer is that you have been hacked!

Please check: https://forum.joomla.org/viewtopic.php?t=903755 on how to clean a possible backdoor left in some PHP file and here my response on additional steps on how to clean the rest here: https://www.linuxquestions.org/questions/linux-enterprise-47/troubleshootd-utilizing-high-cpu-and-memory-933116/

I would recommend updating your php and taking other security mesures like not providing your PHP version info and apache version in the server response. Reinstalling the system looks like a very cumbersome none-sense to me...