This vulnerability involves the leakage of sensitive system information—user password hashes—through debug logs attached to crash reports generated by ubuntu-desktop-provision in Ubuntu 24.04.4. When an installation fails and a user submits a bug report to Launchpad, the attached logs may contain uncleared debug data that exposes these credentials. The CVSS 4.0 base score is 2.7, indicating low severity, with network attack vector and no required privileges or user interaction for exploitation. No official fix or remediation level has been published by Canonical as of the data provided.

The impact is limited to potential exposure of password hashes during crash report submissions, which could allow an attacker with access to these reports to attempt offline password cracking. However, the vulnerability requires a failure scenario and user submission of a bug report, reducing the likelihood of widespread exploitation. No known active exploits exist, and the overall severity is low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when submitting crash reports that may contain sensitive information. Review and sanitize logs before submission if possible. Monitor Canonical's advisories for updates on remediation.