AMD Optimizing CPU Libraries (AOCL) - installation directory permissions: AOCL installs with permissive directory

Impact

AOCL installs with permissive directory permissions, so a low-privileged user can replace library files that privileged processes later load - straightforward privilege escalation to arbitrary code execution. Worth flagging for AI operators specifically: AOCL (BLIS, libFLAME, AOCL-LibM) is exactly what gets installed on AMD nodes to accelerate the CPU side of an ML pipeline, so it is likely present on your hosts and likely loaded by jobs running as someone else.

Who can reach it

Local, low-privileged user who can write into the AOCL installation directory. If tenants share a node and AOCL lives somewhere world-writable, one tenant poisons the next tenant's math library.

What to do

Update AOCL and correct the directory permissions - this is a filesystem ACL fix plus a package update, no reboot and no firmware. Audit the permissions on every math and ML library directory on shared nodes while you are there; the same mistake recurs across vendor-supplied HPC packages.

References