AWS FPGA Dev Kit Fixes Local Privilege Escalation in Installer

The AWS FPGA Developer Kit contains a local privilege escalation vulnerability within its installation component. This hardware-software development kit supports accelerator creation for EC2 F2 instances. The flaw, identified as CVE-2026-85028, stems from insecure temporary file handling during the setup process. Local users could potentially exploit this weakness to gain elevated system access.

Root cause

The vulnerability exists because the installation component creates a temporary file in a directory with insecure permissions. Specifically, the code wrote an allow_non_root function to /tmp/sdk_root_env.exp. This path is predictable and located in a world-writable temporary directory. The installation step reads this file after elevating its own privileges, allowing crafted shell content to be executed.

Attack path

An attacker with local access could place crafted shell content at the predictable temporary path. Because the directory is world-writable, any local user can modify or create files there. When the installation process runs and elevates privileges, it reads the malicious content. This allows the execution of arbitrary code with root privileges on the affected system.

Affected versions

• AWS FPGA Developer Kit versions earlier than 2.3.4 are impacted by this vulnerability
• Version 2.3.4 and later include the necessary fixes for this issue

Mitigation

• Upgrade to AWS FPGA Developer Kit version 2.3.4 or later
• Remove or comment out lines referencing /tmp/sdk_root_env.exp in sdk_setup.sh
• Remove or comment out lines referencing /tmp/sdk_root_env.exp in install_fpga_mgmt_tools.sh
• Ensure any forked or derivative code is patched to incorporate these fixes

Detection notes

Security teams should monitor for unexpected file creations in world-writable directories like /tmp during installation processes. Look for scripts writing executable content to predictable paths before privilege elevation. Check for anomalous process executions that occur immediately after installer scripts run. Verify that temporary files used by installers are created with restrictive permissions. Alert on any shell content placed in shared temporary directories by non-root users.

What to do and how to stay safe: AWS

• Audit your environment for installations of AWS FPGA Developer Kit versions prior to 2.3.4
• Review system logs for unauthorized modifications to temporary directories during software setup
• Restrict write permissions on temporary directories used by critical installation scripts
• Monitor for unexpected privilege escalations following the execution of FPGA management tools

Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You

General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-85028?

It is a vulnerability in the AWS FPGA Developer Kit where insecure temporary file permissions allow local privilege escalation.

Which versions are affected?

All versions of the AWS FPGA Developer Kit prior to 2.3.4 are affected by this security issue.

How can I fix this?

Upgrade to version 2.3.4 or manually remove references to /tmp/sdk_root_env.exp in the installation scripts.