CVE-2026-85028: Creation of Temporary File in Directory with Insecure Permissions in AWS FPGA Development Kit

The AWS FPGA Development Kit before version 2.3.4 contains a vulnerability (CVE-2026-85028) where the FPGA management tool installation component creates a temporary file in a world-writable directory with insecure permissions. This allows local attackers to place crafted shell content at a predictable path, which the installation process reads after privilege escalation, potentially leading to arbitrary code execution with root privileges. The vulnerability arises from the creation and use of the file /tmp/sdk_root_env.exp during installation. The issue was resolved in version 2.3.4 by removing the vulnerable allow_non_root function from this temporary file and sourcing it directly from a safer location. AWS recommends upgrading to version 2.3.4 and patching any forked or derivative code accordingly. As a workaround, users can remove or comment out lines referencing /tmp/sdk_root_env.exp in the sdk_setup.sh and install_fpga_mgmt_tools.sh scripts.

Local users with access to the system can exploit this vulnerability to execute arbitrary code with root privileges by placing crafted shell content in a predictable temporary file path. This could lead to full system compromise on affected installations of the AWS FPGA Development Kit prior to version 2.3.4.

A fix is available in AWS FPGA Developer Kit version 2.3.4, which removes the vulnerable code and changes how the SDK sources necessary functions. Users should upgrade to version 2.3.4 or later. As a workaround, users can remove or comment out lines referencing /tmp/sdk_root_env.exp in the sdk_setup.sh and install_fpga_mgmt_tools.sh scripts to mitigate the issue until they can upgrade. No other vendor advisories indicate additional mitigation steps.