Critical severity · published Dec 8, 2021
CVE-2021-4048
An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3.10.0, as also used in OpenBLAS before version 0.3.18
9.1
CVSS
2.8%
EPSS
No
On KEV
Description
An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3.10.0, as also used in OpenBLAS before version 0.3.18. Specially crafted inputs passed to these functions could cause an application using lapack to crash or possibly disclose portions of its memory.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.8% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Ceph Storage · Redhat
2.0; 3.0; 4.0; 5.0 · source: NVD
EL
Enterprise Linux · Redhat
8.0 · source: NVD
FE
Fedora · Fedoraproject
34; 35 · source: NVD
JU
Julia · Julialang
through 1.6.3; 1.7.0; 1.7.0; 1.7.0; 1.7.0; 1.7.0 · source: NVD
LA
Lapack · Lapack Project
through 3.10.0 · source: NVD
OP
Openblas · Openblas Project
before 0.3.18 · source: NVD
OC
Openshift Container Storage · Redhat
4.0 · source: NVD
OD
Openshift Data Foundation · Redhat
4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-4048
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-4048
Issue Tracking
https://github.com/JuliaLang/julia/issues/42415
Patch
https://github.com/Reference-LAPACK/lapack/commit/38f3eeee3108b18158409ca2a100e6fe03754781
Issue Tracking
https://github.com/Reference-LAPACK/lapack/pull/625
Patch
https://github.com/xianyi/OpenBLAS/commit/2be5ee3cca97a597f2ee2118808a2d5eacea050c
Patch
https://github.com/xianyi/OpenBLAS/commit/337b65133df174796794871b3988cd03426e6d41
Patch
https://github.com/xianyi/OpenBLAS/commit/ddb0ff5353637bb5f5ad060c9620e334c143e3d7
More from Fedora
10.0
CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
10.0
CVE-2015-3306
ProFTPD Improper Access Control Vulnerability
9.8
CVE-2024-4577
Argument Injection in PHP-CGI
9.8
CVE-2021-44026
Roundcube Webmail SQL Injection Vulnerability
9.8
CVE-2021-42013
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)