Description

Creation of a temporary file in a directory with insecure permissions in the FPGA management tool installation component in AWS FPGA Development Kit (aws-fpga) before 2.3.4 might allow local users to execute arbitrary code with root privileges via crafted shell content placed at a predictable path in a world-writable temporary directory, which the installation step reads after elevating its own privileges. To remediate this issue, users should upgrade to version 2.3.4.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-03T19:17:30.083Z",
  "pubdate": "2026-09-03T19:17:30.083Z",
  "executiveSummary": "The AWS FPGA Development Kit (aws-fpga) prior to version 2.3.4 contains a security vulnerability involving the creation of temporary files within directories possessing insecure, world-writable permissions during the installation process.\nThis vulnerability is classified as an insecure temporary file handling flaw, which may lead to local privilege escalation.\nThe vulnerability impacts local users who can leverage the predictable pathing of these temporary files to inject malicious shell content.\nThe risk is significant as it allows an unprivileged local attacker to achieve arbitrary code execution with root-level privileges.\nThe exploitation mechanism relies on a race condition or pre-emptive file placement, where the installation script subsequently elevates its own privileges and executes the attacker-controlled content.\nNo remote network access is required, as the vector is confined to local system interaction.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper management of temporary files within the AWS FPGA Development Kit installation utility. Specifically, the installation component creates files in a world-writable directory (typically within /tmp or similar locations) without adequate permission restrictions or entropy in file naming.\nThe vulnerability manifests because the installation process utilizes a predictable file path for these temporary assets. Because the directory permissions allow any local user to read, write, and execute files within that space, an attacker can anticipate the exact location where the installation utility will write its temporary data.\nThe attack flow proceeds as follows: First, an attacker identifies the predictable naming convention or the static path used by the installation script. Second, prior to the installation process reaching the relevant step, the attacker places a malicious payload—crafted as shell content—into the predictable file location. Third, the installation component, which is designed to elevate its own privileges to root during the installation phase, subsequently accesses, reads, and executes the contents of this malicious file.\nBecause the installation utility runs with elevated privileges, the malicious shell script or binary injected by the attacker is executed in the security context of the root user. This allows the attacker to bypass standard access controls and achieve full system compromise.\nThis flaw is specific to the installation component of the aws-fpga suite. The vulnerability is present in all versions prior to 2.3.4. Successful exploitation requires local access to the target system and timing synchronization to place the payload before the installation script processes the file. Since no authentication is required beyond standard local user access, the barrier to entry for an authenticated local user is minimal.\nThe post-exploitation impact includes complete loss of system integrity, confidentiality, and availability, as the attacker gains the highest level of system control."
}