CVE-2022-46174: Github.com/kubernetes sigs/aws efs csi driver Efs-utils And Aws-efs-csi-driver Have Race Vulnerability
MODERATECVE-2022-46174 is a MODERATE (CVSS 4.2) efs-utils and aws-efs-csi-driver have race vulnerability (CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')) affecting Github.com/kubernetes sigs/aws efs csi driver libraries in the Go ecosystem. The issue involves efs-utils and aws-efs-csi-driver have race condition during concurrent tls mounts. Remediation is available by upgrading affected packages to version 1.4.8.
CVE-2022-46174 at a Glance
Security Impact
CVSS: 4.2
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L).
How to Fix CVE-2022-46174
To remediate this vulnerability, upgrade all affected Github.com/kubernetes sigs/aws efs csi driver dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/kubernetes-sigs/aws-efs-csi-driver to 1.4.8Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/kubernetes-sigs/aws-efs-csi-driverHow to Check if You Are Affected
To determine whether your application is affected by CVE-2022-46174, inspect your project dependencies for Github.com/kubernetes sigs/aws efs csi driver:
inspect dependencies for github.com/kubernetes-sigs/aws-efs-csi-driverAnalyze the terminal output to locate any version of Github.com/kubernetes sigs/aws efs csi driver in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.4.8), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'), where the product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently. In Github.com/kubernetes sigs/aws efs csi driver, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2022-46174 Affected Github.com/kubernetes sigs/aws efs csi driver Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/kubernetes-sigs/aws-efs-csi-driver
|
Go |
< 1.4.8
|
1.4.8
|
References
Frequently Asked Questions
What is CVE-2022-46174?
Which Github.com/kubernetes sigs/aws efs csi driver versions are affected?
What version fixes CVE-2022-46174?
Is github.com/kubernetes-sigs/aws-efs-csi-driver affected?
What is the CVSS score of CVE-2022-46174?
What CWE is associated with CVE-2022-46174?
How can I check Go dependencies for CVE-2022-46174?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-4fv8-w65m-3932",
"modified" : "2022-12-30T16:57:49Z",
"published" : "2022-12-30T16:57:49Z",
"aliases" : [ "CVE-2022-46174" ],
"summary" : "efs-utils and aws-efs-csi-driver have race condition during concurrent TLS mounts",
"details" : "### Impact\nA potential race condition issue exists within the Amazon EFS mount helper in efs-utils versions v1.34.3 and below, and aws-efs-csi-driver versions v1.4.7 and below. When using TLS to mount file systems, the mount helper allocates a local port for stunnel to receive NFS connections prior to applying the TLS tunnel. In affected versions, concurrent mount operations can allocate the same local port, leading to either failed mount operations or an inappropriate mapping from an EFS customer’s local mount points to that customer’s EFS file systems.\n\nAffected versions: efs-utils <= v1.34.3, aws-efs-csi-driver <= v1.4.7\n\n### Patches\nThe patches are included in efs-utils version v1.34.4 and newer, and in aws-efs-csi-driver v1.4.8 and newer.\n\n### Workarounds\nThere is no recommended work around. We recommend affected users update the installed version of efs-utils to v1.34.4+ or aws-efs-csi-driver to v1.4.8+ to address this issue.\n\n### References\nhttps://github.com/aws/efs-utils/commit/f3a8f88167d55caa2f78aeb72d4dc1987a9ed62d\nhttps://github.com/aws/efs-utils/issues/125\nhttps://github.com/kubernetes-sigs/aws-efs-csi-driver/issues/282\nhttps://github.com/kubernetes-sigs/aws-efs-csi-driver/issues/635\n",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/kubernetes-sigs/aws-efs-csi-driver"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "1.4.8"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 1.4.7"
}
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/aws/efs-utils/security/advisories/GHSA-4fv8-w65m-3932"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2022-46174"
}, {
"type" : "WEB",
"url" : "https://github.com/aws/efs-utils/issues/125"
}, {
"type" : "WEB",
"url" : "https://github.com/aws/efs-utils/commit/f3a8f88167d55caa2f78aeb72d4dc1987a9ed62d"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/aws/efs-utils"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-362" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2022-12-30T16:57:49Z",
"nvd_published_at" : "2022-12-28T07:15:00Z"
}
}