CVE-2021-4048: Critical severity Lapack Project Lapack vulnerability
An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3.10.0, as also used in OpenBLAS before version 0.3.18. Specially crafted inputs passed to these functions could cause an application using lapack to crash or possibly disclose portions of its memory.
Other sources
OpenBLAS contains an out-of-bounds read error in the zlarrv.f library that occurs when user input is not validated properly. This could allow a remote attacker to crash the process associated with the library, or potentially expose the contents of memory by executing arbitrary code.
Reference:
https://vulndb.cyberriskanalytics.com/vulnerabilities/270365
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-4048?
The severity of CVE-2021-4048 is critical with a CVSS score of 9.1.
Which software versions are affected by CVE-2021-4048?
CVE-2021-4048 affects lapack through version 3.10.0 and OpenBLAS before version 0.3.18.
How can CVE-2021-4048 be exploited?
CVE-2021-4048 can be exploited by passing specially crafted inputs to the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack.
Is there a fix available for CVE-2021-4048?
Yes, a fix for CVE-2021-4048 is available. Update to a version of lapack after 3.10.0 or OpenBLAS after 0.3.18.
Where can I find more information about CVE-2021-4048?
More information about CVE-2021-4048 can be found at the following references: [Link 1](https://github.com/JuliaLang/julia/issues/42415), [Link 2](https://github.com/Reference-LAPACK/lapack/commit/38f3eeee3108b18158409ca2a100e6fe03754781), [Link 3](https://github.com/Reference-LAPACK/lapack/pull/625).