In plain language
What this advisory means
The AWS FPGA Developer Kit had a security weakness before version 2.3.4. It created temporary files in a shared directory with unsafe permissions, allowing local users to place malicious code there. When the installation tool elevated its privileges, it could accidentally run that malicious code with root-level access. AWS fixed this by changing how these files are handled in version 2.3.4, removing the unsafe file creation step. Users should update to the latest version or apply the recommended workarounds to stay secure.
Technical explanation
How the issue affects the environment
CVE-2026-85028 describes a vulnerability in the AWS FPGA Developer Kit's FPGA management tool installation component prior to version 2.3.4. The installation process created a temporary file (/tmp/sdk_root_env.exp) in a world-writable directory with insecure permissions. Attackers with local access could place crafted shell code at this predictable path. After the installer's privilege escalation to root, this malicious code would be sourced and executed, allowing arbitrary code execution with root privileges. AWS remediated this by removing the vulnerable code that wrote to /tmp/sdk_root_env.exp and instead sourcing functions directly from a secure path (shared/bin/set_common_functions.sh).
Operational impact
Why teams should care
If exploited, an attacker with local access could gain full root privileges on systems running vulnerable versions of the AWS FPGA Developer Kit. This level of access enables complete control over the system, jeopardizing data confidentiality and system integrity. Organizations running EC2 F2 instances with affected kits might face severe security breaches, operational disruption, and compliance violations. Patching or applying workarounds is critical to mitigate these risks.
Immediate action
Upgrade to AWS FPGA Developer Kit version 2.3.4 or later, where the vulnerable file creation code is removed and replaced by secure direct sourcing of functions. Ensure any forked or derivative code incorporates these fixes.
Affected and fixed releases
Temporary risk reduction
Remove or comment out all references to /tmp/sdk_root_env.exp in the sdk_setup.sh and install_fpga_mgmt_tools.sh scripts to prevent sourcing the insecure temporary file during installation.
Evidence and validation checklist
- AWS Security Bulletins official advisory published 09/03/2026
- Description of vulnerability involving temporary file creation in insecure world-writable directory
- Impact on local user ability to execute arbitrary root code
- Fix in version 2.3.4 removing vulnerable file creation
- Workaround instructions to edit install scripts
Authoritative reference
AWS Security Bulletins
QCS detected and normalized this record from the official source. Vendor guidance remains authoritative.