CVE-2024-6714 is a high severity (CVSS 8.8) local privilege escalation in provd, the Ubuntu desktop provisioning service, before version 0.1.5. A setuid binary can be run by any local user to gain root. Canonical fixed it in provd 0.1.5 on Oracular and 0.1.2+24.04 on Noble.
What's affected
The record lists Canonical Ubuntu Desktop Provision, with the issue in provd before 0.1.5. The Launchpad bug says the affected package is provd 0.1.2, and its setuid binary is /usr/libexec/sprovd, which any local user can run.
Fixed versions per the bug: provd 0.1.5 for Ubuntu Oracular, and 0.1.2+24.04 for Ubuntu Noble. Both fixes remove the Ubuntu Pro and Chmod services, which removes the vulnerable binary altogether.
How to check if you're exposed
Check whether the package is installed and which version:
dpkg -l provd
Then check for the binary and its setuid bit:
ls -l /usr/libexec/sprovd
If the file exists and shows an s in the owner permissions, a local user can run it as root. After updating, confirm the file is gone. Also review who has local shell or desktop access to the machine, since the attack needs a local account.
What to do now
- Run your normal package update so provd reaches 0.1.5 on Oracular or 0.1.2+24.04 on Noble.
- Confirm that
/usr/libexec/sprovdno longer exists after the update. - Inventory other setuid binaries on desktop images and review why each is needed.
- Limit local accounts on shared Ubuntu desktops to people who need them.
- Rebuild golden desktop images so new machines do not ship the old package.
Why it matters
The record lists CWE-73, external control of file name or path. The Launchpad bug gives the practical cause: the binary starts subprocesses by finding executables through the PATH environment variable and does not clean its environment. The caller controls PATH, so a program of the caller's choosing can run with root rights.
This is a classic mistake with setuid programs. They run with the owner's privilege, so every input they trust, including environment variables, becomes an attack surface. The vector is local, low complexity and low privileges, with a scope change, which explains the 8.8 score. I found no claim of exploitation, and the record shows it is not known exploited. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan for checking the packages your own projects pull in.
Quick check
Can someone exploit this remotely?
Not directly. The vector is local, so the attacker needs an account on the machine.
How did Canonical fix it?
By removing the Ubuntu Pro and Chmod services, which removes the setuid binary, per the Launchpad bug.
Sources
Last reviewed: 19 October 2026.
