CVE-2026-85028

Executive Summary

CVE-2026-85028 is a local privilege escalation vulnerability in the FPGA development tools installation component of the AWS FPGA Development Kit (aws-fpga) prior to version 2.3.4. The installation routine creates temporary files inside a world-writable directory with insecure permissions, allowing a local unprivileged user to pre-plant crafted shell content at a predictable path. When the installer subsequently elevates its own privileges to root and reads that temporary file, the shell content executes with root privileges. The flaw is confined to local‑only exploitation (CVSS vector AV:L — no network attack surface), but the full impact triad of High confidentiality, integrity, and availability makes it severe for multi‑tenant systems where untrusted users share a host with an operator running an FPGA toolchain installation. No public exploit, CISA KEV listing, or EPSS score exists at the time of this report; patch confidence is 0/4, meaning only a version upgrade (2.3.4) is available as a definitive fix.

Technical Analysis

Vulnerability class. CVE-2026-85028 is classified under CWE-379 (Creation of Temporary File in Directory with Incorrect Permissions). This is a sub‑class of the Common Weakness Enumeration family CWE-377/378/379, which covers insecure temporary file handling. The core defect is a logic and permissions flaw in the installation component of the aws-fpga toolchain, not a bug in the FPGA bitstream generation logic itself.

Attack mechanism. The NVD description states the flaw resides in "the FPGA management tool installation component." During installation, the program creates a temporary file inside a directory that is world-writable — i.e., permissions that allow any local user to create, delete, or modify files within that directory. Critically, the temporary file's name/path is deterministic ("predictable path") rather than being randomized (e.g., via mkstemp-style generation), violating the TOCTOU-safe temp file design pattern.

The installation step "reads after elevating its own privileges," meaning the process first drops its real/effective UID to 0 (or is executed with elevated privileges via sudo or setuid) and then consumes the contents of the temporary file. Because an unprivileged local user can pre-create that exact file at that exact path, they can inject shell syntax into it. When the privileged installer parses or sources that file (e.g., via shell ./source, eval, or by passing its contents to a shell interpreter), the crafted content executes as root.

Why the predictable path matters. If the path were generated using a secure random function with O_EXCL file creation and mode 0600, pre-planting would be impossible. The vulnerable implementation uses a fixed directory (world-writable) plus a deterministic file name, eliminating the race-condition barrier. Even in the absence of a pure symlink attack, the shell content injection is sufficient — this is closer to a "pre-created file poisoning" attack than to a classic symlink race.

Code-level detail. The NVD description provides no function names, class names, or absolute file paths beyond the generic category "FPGA management tool installation component." Per accuracy rules, a serviceable public detail: aws-fpga is an Amazon-maintained, open-source toolkit (API, SDK, and RTL-level development utilities) that users run locally to compile/validate FPGA images and program AWS FPGA instances. On a non-AWS on-premises host, installation components (e.g., setup scripts, hdk_setup.sh, sdk_setup.sh, mcp utilities) are typically executed with sudo to place tools under /opt or to modify kernel modules. The temp file read is plausibly a deployment configuration file read by a shell script after elevation.

Attack surface.

• Local only: requires authenticated shell access on a host where another user runs the aws-fpga installation (or where installation is automated via CI/CD on a shared runner).
• Race-free poisoning: because the path is predictable, no timing component is needed; the attacker can plant the file long before the installer runs.
• No need for the victim to be root — only that the installer spawns with elevated privileges (e.g., user runs sudo ./setup.sh or the package manager escalates via sudo).

Exploitation Scenarios

Preconditions.

• Attacker: local, unprivileged (accounts with standard non‑root access).
• Victim: an administrator or automated process that executes the aws-fpga installation component (version < 2.3.4) with elevated (root) privileges.
• Target path: a world-writable temporary directory (e.g., /tmp, or a less obvious build directory) whose exact location and the name of the temporary file the installer creates are known constants.

_Strictly class‑level attack chain (no public PoC):

1. Reconnaissance / Target identification. The attacker identifies a host with the aws-fpga toolkit installed or about to be installed. This may be visible via running processes (e.g., shell scripts named setup, install, check under the aws-fpga tree), recently modified directories under /tmp, or shell history files of a local admin. The attacker also determines (or guesses, based on common installer patterns) which temporary path the installer will use. Because the NVD says "world-writable temporary directory" and "predictable path," the attacker needs only a directory listing ability, not read privileges anywhere else.

2. Triggering the flaw. The attacker creates a file at the predictable path — e.g., <world-writable-dir>/<predictable-temp-name> — containing crafted shell content. The content is a valid shell script fragment, such as echo 'evil-uid-0' > /tmp/pwned or a more consequential payload, such as useradd -ou 0 -g 0 newroot && echo 'newroot:hash' | chpasswd or a reverse shell spawning a root shell. No elevated action is taken by the attacker at this stage. The attacker then waits for the admin/CI process to start the aws-fpga installation.

3. Payload / execution. When the victim runs the installer with root privileges (via sudo, or because the account running it is root), the installer creates/opens the temp file at the same predictable path. Because the file already exists and is owned by the unprivileged attacker, the installer reads the attacker-controlled content after its privilege elevation. The installer then either (a) executes the content implicitly by sourcing it as a shell script, (b) passes it to an interpreter such as sh -c, or (c) uses a template engine that interprets shell-style substitutions. The exact mechanism is not documented in the NVD description; the class-level outcome is "arbitrary code execution with root privileges."

4. Post-exploitation impact. The attacker’s shell content runs with UID 0. Immediate impact includes: persistence via a new root account, dropping of an SSH authorized_key into /root/.ssh/, installation of kernel backdoors (relevant on FPGA-adjacent hosts, where device firmware flashing may be possible if the hardware is present), and lateral movement to the broader network. Because the attacker already had local login, the additional privilege escalation converts them from a sandboxed user to full host compromise — leading to exfiltration of secrets, tampering with FPGA bitstreams or source code, and denial of service.

Exploitation realism. The attack does not require a race; it is a "plant‑and‑wait" scenario. This materially raises the likelihood relative to other temp-file bugs. However, since no public PoC exists and the specific temp path is not disclosed, the attack chain above is inferred from the CWE-379 class and the NVD description.

Impact Assessment

• CVSS 7.8 (High). Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Low attack complexity (no race needed), low privileges required (a standard local account), and no user interaction.
• Confidentiality / Integrity / Availability — all High. For a single host, root compromise trivially yields full read, write, and denial-of-service capability.
• Blast radius — logical (not network). The reachable population is users of the aws-fpga toolkit on shared or multi-user systems: enterprise development servers, CI/CD agents with local runners, engineering workstations in multi‑seat labs, and containers where an unprivileged workload co‑exists with a host‑install run. The exploit does NOT travel over the network; it requires a co‑resident attacker.
• Environment conditions. The exploit requires the vulnerable installer to be executed on a host where unprivileged users are also present. Single‑user workstations are effectively unaffected (only the user harming themselves). Data centers or DevOps environments where FPGA builds are performed by different users than the host administrator are the primary risk group.
• Supply-chain subtext. Because aws-fpga is an open-source (permissive license) project redistributed or used as a dependency by third-party FPGA tooling and CI pipelines, a user of the toolkit might unknowingly inherit the vulnerability even if they never run the direct AWS distribution.

Detection Guidance

Detection for a local file‑poisoning CVE is challenging because no network traffic crosses the trust boundary. The guidance below focuses on (1) filesystem activity — creation of unusual files in world-writable dirs, and (2) immediate process behavior after an installer reads a tampered file (spawning of shells as root, unexpected account creation).

Sigma Rule

Sigma — local file creation in common world-writable directories by a non-root user where the file name looks like a tool-generated temp file, followed by execution of that file by a root-owned process.

title: AWS FPGA Toolkit Installer - Suspicious Temp File in World-Writable Dir
id: 8f3ccdb0-77f4-4d45-8e27-135f6a7f2843
status: experimental
description: Detects creation of predictable-named files in world-writable dirs by non-root users, ahead of a potential aws-fpga installer execution (CVE-2026-85028).
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-85028
author: Valtersit Threat Intel Team
date: 2026/02/17
logsource:
    category: file_event
    product: linux
detection:
    selection_writable_dir:
        TargetFilename|startswith:
            - '/tmp/'
            - '/var/tmp/'
            - '/dev/shm/'
    selection_creator:
        User|endswith:
            - '\\-1'      # non-root user (replace with actual UID!=0 condition in your SIEM)
    selection_likely_setup:
        TargetFilename|contains|all:
            - 'aws'
            - 'fpga'
            - '.sh'
    condition: selection_writable_dir and selection_creator and selection_likely_setup
falsepositives:
    - Legit users copying scripts to /tmp for reference
    - Build tools writing reproducible temp files
level: medium
tags:
    - attack.t1068
    - cve.2026.85028

YARA Rule

YARA — intended for static file triage of such prefabricated poison-files or for on-access scanning of directories on endpoints where the installer is expected to run.

rule CVE_2026_85028_aws_fpga_installer_temp_poison {
    meta:
        author      = "Valtersit Threat Intel Team"
        description = "Detects presence of likely temp-file poison content aimed at aws-fpga installer (CVE-2026-85028)."
        cve         = "CVE-2026-85028"
        date        = "2026-02-17"
        score       = 70
    strings:
        $installer_ref = "aws-fpga"
        $installer_ref2 = "fpga"
        $shell_marker_1 = "#!/bin/sh"
        $shell_marker_2 = "#!/bin/bash"
        $useradd      = "useradd"
        $chmod        = "chmod"
        $uid0         = "uid 0"
        $reverse_shell = "nc -e"
        $reverse_shell2 = "/bin/sh -i"
    condition:
        uint16(0) == 0x2321 and           // shebang comment start
        2 of ($shell_marker_*) and
        (1 of ($installer_ref*)) and
        (1 of ($useradd, $uid0, $reverse_shell, $reverse_shell2, $chmod))
}

Suricata IDS Rule

Suricata is primarily a network IDS — this vulnerability is local-only, so a faithful network rule is not feasible. The following rule is intentionally minimal and detects only postcompromise C2-style beaconing from a compromised host (root shell outbound). Operators are advised that this rule provides opportunistic detection only, not primary defence.

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-85028 post-exploit request to C2 (low-confidence, opportunistic)"; flow:to_server,established; content:"id"; nocase; content:"uid=0"; nocase; distance:20; within:100; classtype:trojan-activity; sid:202685028; rev:1; metadata:created_at 2026_02_17, cve CVE-2026-85028;)

Elastic Detection

EQL — user creation events or privilege-escalation timing windows; assumes endpoint events (Sysmon-like, Auditd via Filebeat, or Endgame) are shipped to Elasticsearch.

// Detect creation of a new account with UID 0 shortly after a process named *fpga*/*aws* started with root privileges
sequence by host.id with maxspan=10s
  [ process where process.name in ("hdk_setup.sh", "sdk_setup.sh", "install.sh", "aws-fpga-setup") and process.user.name == "root" ]
  [ event where event.action == "useradd" or event.action == "account-created"
    and user.name == "root" and user.id == "0" ]

// Detect a root-owned shell spawning immediately after aws-fpga-related installer
process where process.user.id == "0"
  and process.parent.name in ("aws-fpga-setup", "install.sh", "hdk_setup.sh", "sdk_setup.sh")
  and process.name in ("sh", "bash", "dash", "nc", "python", "perl")

Splunk SPL Query

index=linux sourcetype=linux_audit OR sourcetype=linux_secure
| search (user!="root" AND object_category="file" AND action="write"
      AND file_path IN ("/tmp/*", "/var/tmp/*", "/dev/shm/*"))
  OR (user="root" AND comm IN ("sh","bash","dash","useradd","chpasswd"))
| stats count BY user, file_path, comm, _time
| where user!="root" AND (file_path LIKE "%fpga%" OR file_path LIKE "%aws%")
| sort _time asc
| head 100

Wazuh OSSEC Rule

Wazuh — detection via syscheck or via active response to unusual root shells spawning from installer binaries.

<group name="aws-fpga, CVE-2026-85028,">
  <rule id="202850" level="12">
    <if_sid>510, 511</if_sid>  <!-- New file in /tmp or file event -->
    <field name="file" >\.(fpga|aws).*</field>
    <description>lateral file found in /tmp that looks like aws-fpga temp-file poison (CVE-2026-85028)</description>
    <group>aws_fpga, cve_2026_85028, rootkit,</group>
  </rule>

  <rule id="202851" level="15">
    <if_sid>550</if_sid>  <!-- Process spawn (audit) -->
    <field name="process.name">^(sh|bash|dash|nc)$</field>
    <field name="user.name">root</field>
    <field name="parent.process.name">^.*(aws|fpga).*$</field>
    <description>Root shell spawned by aws-fpga installer — possible CVE-2026-85028 code execution</description>
    <group>aws_fpga, cve_2026_85028, privilege_escalation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No source-level patch, hotfix, or backport has been identified by any of the four tracked sources. The sole remediation stated by the vendor is version 2.3.4: "upgrade to version 2.3.4." No CVE-specific advisory URL from AWS, no CISA KEV entry, and no researcher blog exist in our threat-intel corpus at the time of writing.

1. Immediate mitigations (until upgrade):

• Restrict interactive local logins: remove or disable shell accounts for any user who is not strictly required to log into the host, particularly on shared CI runners where a Jenkins/Runner account may be eligible for file creation but has no legitimate interactive use.
• Restrict sudo/elevation to installer commands: ensure the aws-fpga installer does not run under a blanket sudo -i; instead create a dedicated low-privilege technical account that invokes the installer only when needed, and use sudo with an exact command allowlist (e.g., hdk_setup.sh and sdk_setup.sh only).
• Remove world-writable directories from the temp set: if feasible, set a restrictive /tmp mount using mount -o nosuid,nodev and set sticky bit is insufficient — the attacker can still create a file in it. The essential point is to prevent the installer from reading a file created by another user — not to prevent its creation. There is no workaround for the predictable-name logic itself; only stopping the installer process from using the world-writable path is effective. As a stopgap: run the installer under a non-root account that cannot read /tmp (change the installer’s umask and mount an overlay over the tmp dir for the installer’s execution context).
• Monitor /tmp and /dev/shm for creation of files whose names contain aws or fpga by a non-root user less than 10 minutes before installer execution, via the Sigma/EQL rules above.

2. Patch/upgrade steps:

• Upgrade to aws-fpga 2.3.4 (release channel as per AWS Official GitHub) using the standard v2.x upgrade method: pull the tag, run the installer with a clean temp-dir set. Do not download from mirrors; use the official GitHub release.
• Verify hashes / GPG signatures from the AWS release page before installation.
• Post-upgrade, run the following checks: aws-fpga --version or equivalent show 2.3.4; scan the previous /tmp remnants — find /tmp /var/tmp -name '*fpga*' -o -name '*aws*' and review them.

3. Long-term hardening:

• Apply the secure temp-file pattern project-wide: any future installation component must use mkstemp-style opens with O_EXCL, mode 0600, and must refuse to overwrite an existing file (defends against a planted file) regardless of who owns it.
• Audit all installer shell scripts for eval, .-sourcing, or $(cat file) patterns that read arbitrary paths after privilege elevation — replace with explicit checks that the file owner is root and the directory is mode 0700.
• Principle of least privilege: require root only for FPGA device operations; perform all ordinary file staging and config-preparation steps as the unprivileged development user.
• Add detection coverage: extend your SIEM/EDR to flag any process escalated to UID 0 that subsequently reads from /tmp or /dev/shm within the first 60 seconds of elevation — regardless of the tool name — because this pattern generalises to the entire CWE-379 family.

References

1. NVD Entry — CVE-2026-85028 — https://nvd.nist.gov/vuln/detail/CVE-2026-85028 — authoritative CVE description and CVSS 7.8 vector (accessed 2026-02-17).
2. CWE-379 — Creation of Temporary File in Directory with Incorrect Permissions — https://cwe.mitre.org/data/definitions/379.html — class definition for this weakness family.
3. AWS FPGA Development Kit (aws-fpga) GitHub Repository — https://github.com/aws/aws-fpga — vendor distribution point for the patched version 2.3.4; release history and upgrade path.
4. CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog — confirmed NO KEV entry for this CVE at publication time (checked 2026-02-17); monitor for future inclusion.
5. MITRE ATT&CK — T1068 Exploitation for Privilege Escalation — https://attack.mitre.org/techniques/T1068/ — relevant kill-chain phase reference.

Additional threat-intel notes: As of 2026-02-17, there is no known active exploitation in the wild, no public exploit code, and no Nuclei or equivalent automated scanner template. The low complexity of the flaw (no race condition, predictable path) suggests a realistic chance that proof-of-concept code emerges shortly after public disclosure of the exact temp-file path. Enterprise customers using aws-fpga < 2.3.4 on multi-tenant systems should treat the vulnerability as a high‑priority local privilege‑escalation risk while the patch is pending, and follow the detection guidance above for early visibility.