CVE-2024-6714
📋 TL;DR
This vulnerability in provd (Ubuntu Desktop Provision) before version 0.1.5 involves a setuid binary that allows local attackers to escalate privileges. It affects Ubuntu systems with provd installed, enabling attackers to gain root access from a standard user account.
💻 Affected Systems
- provd (Ubuntu Desktop Provision)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains full root privileges, compromising the entire system and all data.
Likely Case
Local user or attacker with initial access escalates to root, enabling persistence, lateral movement, and full system control.
If Mitigated
With proper patching, the vulnerability is eliminated; without patching, strong access controls limit exposure to authorized users only.
🎯 Exploit Status
Requires local access but likely straightforward to exploit given setuid nature and CWE-73 (External Control of File Name or Path).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.1.5
Vendor Advisory: https://bugs.launchpad.net/ubuntu/+source/provd/+bug/2071574
Restart Required: No
Instructions:
1. Update provd package to version 0.1.5 or later via apt. 2. Run: sudo apt update && sudo apt upgrade provd. 3. Verify installation with: dpkg -l | grep provd.
🔧 Temporary Workarounds
Remove setuid bit temporarily
linuxRemove setuid permission from the vulnerable binary to prevent privilege escalation.
sudo chmod u-s /usr/bin/provd
Restrict binary execution
linuxRemove execute permissions for non-root users.
sudo chmod o-x /usr/bin/provd
🧯 If You Can't Patch
- Implement strict access controls to limit local user accounts and monitor for suspicious privilege escalation attempts.
- Use mandatory access control systems like SELinux or AppArmor to restrict provd binary execution.
🔍 How to Verify
Check if Vulnerable:
Check provd version: dpkg -l | grep provd. If version is earlier than 0.1.5, system is vulnerable.Check Version:
dpkg -l | grep provdVerify Fix Applied:
Confirm provd version is 0.1.5 or later: dpkg -l | grep provd. Also verify setuid bit is properly configured.📡 Detection & Monitoring
Log Indicators:
- Unusual privilege escalation attempts via provd binary
- Failed or successful setuid executions in audit logs
Network Indicators:
- None - this is a local exploit
SIEM Query:
Process execution where parent is non-root user and binary is /usr/bin/provd with setuid flag🔗 References
- https://bugs.launchpad.net/ubuntu/+source/provd/+bug/2071574
- https://github.com/canonical/ubuntu-desktop-provision/commit/8d9086de0f82894ff27a9e429ff4f45231020092
- https://www.cve.org/CVERecord?id=CVE-2024-6714
- https://bugs.launchpad.net/ubuntu/+source/provd/+bug/2071574
- https://github.com/canonical/ubuntu-desktop-provision/commit/8d9086de0f82894ff27a9e429ff4f45231020092
- https://www.cve.org/CVERecord?id=CVE-2024-6714
