Aws Fpga
Monthly
Privilege escalation to root in the AWS FPGA Development Kit (aws-fpga) before version 2.3.4 is achievable when a local low-privileged user pre-places malicious shell content at the predictable path `/tmp/sdk_root_env.exp`, which the `sdk_setup.sh` installation script sources after elevating its own privileges. The root cause (CWE-379) is the installation component writing a shell function file to the world-writable `/tmp` directory without using secure temporary file practices, making the path guessable and controllable by any local account. Amazon released a fix in v2.3.4 that removes the offending write step entirely, sourcing the function directly from `shared/bin/set_common_functions.sh` instead; no public exploit has been identified at time of analysis.
Privilege escalation to root in the AWS FPGA Development Kit (aws-fpga) before version 2.3.4 is achievable when a local low-privileged user pre-places malicious shell content at the predictable path `/tmp/sdk_root_env.exp`, which the `sdk_setup.sh` installation script sources after elevating its own privileges. The root cause (CWE-379) is the installation component writing a shell function file to the world-writable `/tmp` directory without using secure temporary file practices, making the path guessable and controllable by any local account. Amazon released a fix in v2.3.4 that removes the offending write step entirely, sourcing the function directly from `shared/bin/set_common_functions.sh` instead; no public exploit has been identified at time of analysis.