Executive brief
The AWS FPGA Development Kit is used by developers to create hardware accelerators for high-performance compute instances in AWS. A vulnerability in the FPGA management tool's installation component allows local users to execute arbitrary code with root privileges by placing malicious files in a world-writable temporary directory that the installer later reads after elevating privileges. This could allow an attacker with local access to gain complete system control.
Technical details
CVE-2026-85028 is a privilege escalation vulnerability in aws-fpga before version 2.3.4 involving insecure temporary file creation in the FPGA management tool installation component. The vulnerability class is CWE-377 (Insecure Temporary File), where the installation process creates temporary files in a world-writable directory with predictable paths. An attacker with local system access can race to create malicious shell scripts at these predictable locations before the installer reads them. When the installation process later elevates privileges (via sudo or similar), it executes the attacker-controlled content, resulting in arbitrary code execution with root privileges. The attack requires local access to the system but no special authentication is required. Versions prior to 2.3.4 are affected; users should upgrade to version 2.3.4 or later.
Affected products
- AWS FPGA Development Kit < 2.3.4
Timeline
- 2026-09-09: disclosed: Vulnerability published by AWS