Creation of Temporary File in Directory with Insecure Permissions in AWS FPGA Development Kit

**CVSSv3.1 Rating:** High **CVSSv3.1 Score:** 7.8 **CVSSv3.1 Vector String:** CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H **Summary** The AWS FPGA Developer Kit is a hardware-software development kit that enables developers to create accelerators for the high-performance accelerator cards on EC2 F2 instances. An issue exists where, under certain circumstances, an unprivileged local user can achieve arbitrary code execution as root by exploiting a world-writable temporary file that is sourced with root privileges during the SDK installation process. **Impact** The install_fpga_mgmt_tools.sh script self-elevates to root and unconditionally sources a file at a fixed, predictable path (/tmp/sdk_root_env.exp) in the world-writable /tmp directory without checking the file's existence, ownership, or permissions. A local unprivileged user on the same host (for example, a second account on a shared multi-user F2 development instance) can pre-create or replace /tmp/sdk_root_env.exp with arbitrary shell content. When an administrator subsequently runs the documented install step, the actor-controlled file is sourced with full root privileges, resulting in local privilege escalation to root. This issue exists only in the open-source SDK installation script that runs on customer-managed hosts. The AWS-managed service infrastructure used for ingesting, validating, and loading Amazon FPGA Images (AFIs) is not affected by this issue. **Impacted versions:** < 2.3.4 **Patches** This issue has been addressed in the AWS FPGA Developer Kit version 2.3.4. The offending code that wrote the allow_non_root function to /tmp/sdk_root_env.exp has been removed; the SDK tools now source it directly from shared/bin/set_common_functions.sh. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. **Workarounds** Remove or comment out lines referencing /tmp/sdk_root_env.exp in sdk_setup.sh and install_fpga_mgmt_tools.sh. **References** If you have any questions or comments about this advisory, we ask that you contact AWSSecurity via our [issue reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue. **Acknowledgement** We would like to thank George Chen ([@geo-chen](https://github.com/geo-chen)) for collaborating on this issue through the coordinated vulnerability disclosure process. Please email [aws-security@amazon.com](mailto:aws-security@amazon.com) with any security questions or concerns.

Severity from

GitHub (reviewed advisory)

• github.com/aws/aws-fpga/security/advisories/GHSA-g4hc-wrmm-2x74
• github.com/aws/aws-fpga