{"cve":"CVE-2022-46174","nvd":{"published":"2022-12-28T07:15:08.860","modified":"2026-06-17T05:11:21.823","status":"Modified","description":"efs-utils is a set of Utilities for Amazon Elastic File System (EFS). A potential race condition issue exists within the Amazon EFS mount helper in efs-utils versions v1.34.3 and below. When using TLS to mount file systems, the mount helper allocates a local port for stunnel to receive NFS connections prior to applying the TLS tunnel. In affected versions, concurrent mount operations can allocate the same local port, leading to either failed mount operations or an inappropriate mapping from an EFS customer’s local mount points to that customer’s EFS file systems. This issue is patched in version v1.34.4. There is no recommended work around. We recommend affected users update the installed version of efs-utils to v1.34.4 or later.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","score":4.2},"cwes":["CWE-362"],"references":["https://github.com/aws/efs-utils/commit/f3a8f88167d55caa2f78aeb72d4dc1987a9ed62d","https://github.com/aws/efs-utils/issues/125","https://github.com/aws/efs-utils/security/advisories/GHSA-4fv8-w65m-3932","https://github.com/aws/efs-utils/commit/f3a8f88167d55caa2f78aeb72d4dc1987a9ed62d","https://github.com/aws/efs-utils/issues/125"],"products":["amazon:efs-utils","amazon:elastic_file_system_container_storage_interface_driver"],"source":"nvd","synced_at":"2026-10-19T21:37:31.370122805+00:00"},"epss":{"cve":"CVE-2022-46174","score":0.0064,"percentile":0.50678,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-4fv8-w65m-3932","url":"https://osv.dev/vulnerability/GHSA-4fv8-w65m-3932","summary":"efs-utils and aws-efs-csi-driver have race condition during concurrent TLS mounts","modified":"2023-11-08T04:10:55.890554Z","packages":[{"ecosystem":"Go","name":"github.com/kubernetes-sigs/aws-efs-csi-driver","purl":"pkg:golang/github.com/kubernetes-sigs/aws-efs-csi-driver","ranges":["<1.4.8"],"fixed":["1.4.8"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}