CVE-2021-4048

high-risk

Published 2021-12-08

An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3.10.0, as also used in OpenBLAS before version 0.3.18. Specially crafted inputs passed to these functions could cause an application using lapack to crash or possibly disclose portions of its memory.

Do I need to act?

0.36% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 9.1/10 Critical

NETWORK / LOW complexity

Affected Products (17)

Lapack

Openblas

Julia

Ceph Storage

Openshift Container Storage

Openshift Data Foundation

Enterprise Linux

Fedora

Affected Vendors

Redhat Fedoraproject Lapack Project Openblas Project Julialang

References (18)

Issue Tracking https://github.com/JuliaLang/julia/issues/42415

Patch https://github.com/Reference-LAPACK/lapack/commit/38f3eeee3108b18158409ca2a100e6...

Issue Tracking https://github.com/Reference-LAPACK/lapack/pull/625

Patch https://github.com/xianyi/OpenBLAS/commit/2be5ee3cca97a597f2ee2118808a2d5eacea05...

Patch https://github.com/xianyi/OpenBLAS/commit/337b65133df174796794871b3988cd03426e6d...

Patch https://github.com/xianyi/OpenBLAS/commit/ddb0ff5353637bb5f5ad060c9620e334c143e3...

Patch https://github.com/xianyi/OpenBLAS/commit/fe497efa0510466fd93578aaf9da1ad8ed4edb...

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Issue Tracking https://github.com/JuliaLang/julia/issues/42415

Patch https://github.com/Reference-LAPACK/lapack/commit/38f3eeee3108b18158409ca2a100e6...

Issue Tracking https://github.com/Reference-LAPACK/lapack/pull/625

Patch https://github.com/xianyi/OpenBLAS/commit/2be5ee3cca97a597f2ee2118808a2d5eacea05...

Patch https://github.com/xianyi/OpenBLAS/commit/337b65133df174796794871b3988cd03426e6d...

Patch https://github.com/xianyi/OpenBLAS/commit/ddb0ff5353637bb5f5ad060c9620e334c143e3...

Patch https://github.com/xianyi/OpenBLAS/commit/fe497efa0510466fd93578aaf9da1ad8ed4edb...

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

/ 100

high-risk

Severity 31/34 · Critical

Exploitability 1/34 · Minimal

Exposure 19/34 · Moderate