Antivirus v2.3.5x -v2.3.7x causes VM's to fail with TAS tile due to memory consumption by clamd

Products

• VMware Tanzu Application Service for VMs

Issue/Introduction

• The combination of TAS tile and Antivirus tile v2.3.5x-v2.3.7x can cause TAS VM's to become unresponsive and fail. (using command: "bosh vms" will show the failing/unresponsive vm's)
• This issue can be further confirmed by running the command "top or htop" on a failing VM and will show "clamd" process consuming the memory as shown below:

 

 

Cause

The issue stems from Antivirus tile itself starting with AV tile v2.3.51, and occurs when combining with any version of TAS for VMs.

# Notable: The below condition must be present in order for the issue to occur:

1. The setting "On access-scanning in Linux" is selected in the Antivirus tile. (as shown below), 

VMware by Broadcoms' Platform Security R&D team has confirmed the below findings to be causing issue.

• For Antivirus tile v2.3.51-v2.3.62, the degraded VM performance is caused by the upstream software utilized by the Antivirus tile, and can be reliably reproduced with clamonacc distributed with CalmAV 1.0.4, which is the current LTS version.
• For Anitviurs tile v2.3.63-v2.3.73, the degraded VM performance is caused by clamonacc process/app not being limited by cgroups.

Resolution

There is currently no fix available for the Antivirus tile version(s) referenced in this article.  VMware by Broadcom's internal Security teams are aware and working to resolve the issue.  When the fix/patch becomes available, this KB article will be updated.  Users can Subscribe to this KB to receive real time updates when they are made available.

 

# Temporary Fix:
Users can choose one of the following 3 workarounds:

1. Downgrade to Antivirus tile v2.3.38 (supported until April 2025)
2. Remove Antivirus Tile
3. Disable / Unselect the “On access-scanning on Linux” in the Antivirus tile config. The issue is specific to that setting. (see pic below)

Additional Information

# Noteable:

• If using the downgrade workaround above, follow the recommended TAS VM sizes and allocate adequate memory to the Antivirus tile per the docs.  (https://techdocs.broadcom.com/us/en/vmware-tanzu/platform-services/anti-virus-for-tanzu/2-3/antivirus-tanzu/install-mirror.html#:~:text=VMware%20Tanzu.-,Prerequisites,-To%20install%20the)