AWS Patches Privilege Escalation Flaw in FPGA Developer Kit
A vulnerability in the AWS FPGA Developer Kit allowed local users to run code as root. Version 2.3.4 fixes the insecure temporary file handling.
Key points
- CVE-2026-85028 affects AWS FPGA Development Kit versions prior to 2.3.4.
- Attackers could execute arbitrary code with root privileges via crafted shell content.
- AWS released a patch and recommended removing specific lines referencing /tmp/sdk_root_env.exp.
Amazon Web Services published security bulletin 2026-096-AWS on September 3, 2026, addressing a privilege escalation vulnerability in its FPGA Developer Kit. The advisory, designated CVE-2026-85028, warns that local users could potentially execute arbitrary code with root privileges on affected systems.
At a glance
- Publisher
- AWS Security Bulletins
- CVEs
- CVE-2026-85028
The flaw exists in the FPGA management tool installation component of the AWS FPGA Development Kit. According to the bulletin, the issue arises from the creation of a temporary file in a directory with insecure permissions. This behavior allows attackers to place crafted shell content at a predictable path within a world-writable temporary directory.
Technical Details and Fix
The installation step reads this temporary file after elevating its own privileges, enabling the execution of the malicious content. AWS stated that this issue has been addressed in version 2.3.4 of the AWS FPGA Developer Kit. The vendor removed the affected code that wrote the allow_non_root function to /tmp/sdk_root_env.exp.
Instead of writing to the temporary directory, the SDK tools now source the function directly from shared/bin/set_common_functions.sh. AWS recommends that users upgrade to the latest version immediately. The company also advises ensuring that any forked or derivative code is patched to incorporate these new fixes.
Affected Systems and Disclosure
The vulnerability impacts all versions of the AWS FPGA Development Kit before 2.3.4. This hardware-software development kit enables developers to create accelerators for high-performance accelerator cards on EC2 F2 instances. George Chen is credited by AWS for collaborating on the issue through the coordinated vulnerability disclosure process.
Users should remove or comment out lines referencing /tmp/sdk_root_env.exp in sdk_setup.sh and install_fpga_mgmt_tools.sh if they cannot upgrade immediately. AWS notes that the bulletin is classified as Important and requires attention from administrators managing these development environments.
What should you do?
Administrators should verify their current version of the AWS FPGA Development Kit against the vulnerable range. If running a version prior to 2.3.4, they should prioritize upgrading to the latest release. Organizations should also audit any custom or forked versions of the SDK to ensure the insecure temporary file handling has been eliminated.
Background: Coordinated vulnerability disclosure
Coordinated vulnerability disclosure reveals software flaws to vendors before public release. Small teams must patch during this quiet period. Monitor vendor security pages, prioritize critical updates, and verify that your IT provider tracks these disclosures to prevent exploitation of known weaknesses before public patches arrive.
Read the full guide: Coordinated Vulnerability Disclosure for Small Teams
What to do and how to stay safe: AWS
- Check installed versions of the AWS FPGA Development Kit to identify if they are below version 2.3.4.
- Upgrade to version 2.3.4 or later once the vendor provides the update to address the insecure permissions.
- Review custom scripts or forked code for references to /tmp/sdk_root_env.exp and remove or comment them out.
- Monitor AWS security bulletins for further guidance on FPGA development kit vulnerabilities and patches.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-85028?
It is a vulnerability in the AWS FPGA Development Kit where insecure temporary file permissions allow local privilege escalation.
Which versions are affected?
All versions of the AWS FPGA Development Kit before 2.3.4 are impacted by this security issue.
How is the vulnerability fixed?
AWS released version 2.3.4, which removes the code writing to /tmp/sdk_root_env.exp and sources functions from a secure location.
