An authenticated Kubernetes user with elevated privileges can exploit an unverified ownership flaw in the Amazon EFS CSI Driver to cause destructive recursive deletion of unauthorized file directories.

The flaw exists in the volume deletion component of the driver, where improper ownership verification allows a user with PersistentVolume creation privileges to manipulate volumeHandles. By pairing an access point from one filesystem with a different target, an authenticated attacker can force the system to delete data on filesystems they are not authorized to access.

This vulnerability poses a significant risk to data integrity and availability, as an attacker could maliciously delete critical directories across unauthorized EFS filesystems. Given the CVSS score of 8.7, this is classified as a high-severity issue that could result in substantial operational disruption and irreversible data loss. Organizations relying on Amazon EFS for shared storage must prioritize this update to prevent potential administrative abuse.

Immediate Action: Upgrade the Amazon EFS CSI Driver to version v3.4.1 or later to implement proper ownership verification during volume deletion.

Proactive Monitoring: Review Kubernetes audit logs for suspicious PersistentVolume creation events or unexpected volume deletion activities involving EFS resources.

Compensating Controls: Restrict Kubernetes role-based access control (RBAC) permissions to limit who can create PersistentVolumes until the driver has been successfully patched.

Public Exploit Available: No

The high CVSS score reflects the potential for severe, unauthorized data loss within cloud environments. Security teams should immediately initiate the update process for the aws-efs-csi-driver to version v3.4.1 across all affected clusters. Furthermore, verify that current RBAC policies adhere to the principle of least privilege to prevent unauthorized users from gaining the PersistentVolume creation permissions necessary to trigger this exploit.