CVE-2026-85028 in aws-fpga
Summary
by MITRE • 09/03/2026
Creation of a temporary file in a directory with insecure permissions in the FPGA management tool installation component in AWS FPGA Development Kit (aws-fpga) before 2.3.4 might allow local users to execute arbitrary code with root privileges via crafted shell content placed at a predictable path in a world-writable temporary directory, which the installation step reads after elevating its own privileges.
To remediate this issue, users should upgrade to version 2.3.4.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/03/2026
The vulnerability identified within the AWS FPGA Development Kit prior to version 2.3.4 represents a critical privilege escalation flaw rooted in insecure temporary file creation practices during the installation process of the FPGA management tool component. This issue specifically affects systems where local users can interact with the installation scripts or binaries, allowing them to manipulate files before they are read by an elevated-privilege context. The core technical failure lies in the use of predictable filenames within a world-writable temporary directory for storing sensitive configuration data or shell content that is subsequently executed during privilege elevation steps. By leveraging this race condition and path predictability, an attacker can pre-create malicious scripts at these known locations, effectively hijacking the execution flow when the installer runs with root privileges to read and process those files.
From a technical perspective, this vulnerability aligns closely with Common Weakness Enumeration category CWE-377, which describes insecure temporary file creation without using secure naming conventions or atomic operations. The installation mechanism fails to employ standard security controls such as mktemp for generating unique filenames or setting restrictive permissions like umask 077 immediately upon file creation. Instead, it relies on static paths that are easily guessable by any local user account on the system. When the installer script executes with elevated privileges, it assumes the integrity of files in these temporary directories without verifying their ownership or content origin. This assumption allows a malicious actor to place crafted shell scripts containing arbitrary commands at the expected path, which are then executed as root due to the trust relationship established by the installation process.
The operational impact of this vulnerability is severe, granting local users the ability to achieve full system compromise with root privileges. Once an attacker successfully injects their payload into the predictable temporary file location, they can execute arbitrary code within the context of the installer's elevated permissions. This effectively bypasses standard access controls and allows for complete takeover of the host machine hosting the FPGA development environment. Such a breach could lead to data exfiltration, persistence mechanisms being established by attackers, or further lateral movement across networked systems if the compromised instance is part of a larger infrastructure. The risk is particularly acute in multi-tenant environments where multiple users share access to the same system resources and temporary directories.
To mitigate this vulnerability, organizations must upgrade the AWS FPGA Development Kit to version 2.3.4 or later, which addresses these insecure file handling practices by implementing secure temporary file creation mechanisms. In addition to upgrading software components, administrators should enforce strict umask settings across all systems running older versions of the kit and review installation scripts for any other instances of predictable temp file usage. Security teams should also monitor system logs for unusual activity in world-writable directories such as /tmp or /var/tmp, particularly around times when FPGA-related installations are performed. Aligning remediation efforts with ATT&CK technique T1059 Command and Scripting Interpreter can help identify if any exploitation attempts have occurred by detecting the execution of unexpected shell scripts during installation processes.