CVE-2021-4048 : An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV f

An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3.10.0, as also used in OpenBLAS before version 0.3.18. Specially crafted inputs passed to these functions could cause an application using lapack to crash or possibly disclose portions of its memory.

Published 2021-12-08 22:15:10

Updated 2022-01-04 16:09:23

Source Red Hat, Inc.

View at NVD, CVE.org

Products affected by CVE-2021-4048

Redhat » Enterprise Linux » Version: 8.0
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
Matching versions
Redhat » Ceph Storage » Version: 2.0
cpe:2.3:a:redhat:ceph_storage:2.0:*:*:*:*:*:*:*
Matching versions
Redhat » Ceph Storage » Version: 3.0
cpe:2.3:a:redhat:ceph_storage:3.0:*:*:*:*:*:*:*
Matching versions
Redhat » Ceph Storage » Version: 4.0
cpe:2.3:a:redhat:ceph_storage:4.0:*:*:*:*:*:*:*
Matching versions
Redhat » Ceph Storage » Version: 5.0
cpe:2.3:a:redhat:ceph_storage:5.0:*:*:*:*:*:*:*
Matching versions
Redhat » Openshift Container Storage » Version: 4.0
cpe:2.3:a:redhat:openshift_container_storage:4.0:*:*:*:*:*:*:*
Matching versions
Redhat » Openshift Data Foundation » Version: 4.0
cpe:2.3:a:redhat:openshift_data_foundation:4.0:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 34
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 35
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
Matching versions
Lapack Project » Lapack
Versions up to, including, (<=) 3.10.0
cpe:2.3:a:lapack_project:lapack:*:*:*:*:*:*:*:*
Matching versions
Openblas Project » Openblas
Versions before (<) 0.3.18
cpe:2.3:a:openblas_project:openblas:*:*:*:*:*:*:*:*
Matching versions
Julialang » Julia
Versions up to, including, (<=) 1.6.3
cpe:2.3:a:julialang:julia:*:*:*:*:*:*:*:*
Matching versions
Julialang » Julia » Version: 1.7.0 Update Beta1
cpe:2.3:a:julialang:julia:1.7.0:beta1:*:*:*:*:*:*
Matching versions
Julialang » Julia » Version: 1.7.0 Update Beta2
cpe:2.3:a:julialang:julia:1.7.0:beta2:*:*:*:*:*:*
Matching versions
Julialang » Julia » Version: 1.7.0 Update Beta3
cpe:2.3:a:julialang:julia:1.7.0:beta3:*:*:*:*:*:*
Matching versions
Julialang » Julia » Version: 1.7.0 Update Beta4
cpe:2.3:a:julialang:julia:1.7.0:beta4:*:*:*:*:*:*
Matching versions
Julialang » Julia » Version: 1.7.0 Update RC1
cpe:2.3:a:julialang:julia:1.7.0:rc1:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2021-4048

Top countries where our scanners detected CVE-2021-4048

Top open port discovered on systems with this issue 53

IPs affected by CVE-2021-4048 56,703

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2021-4048!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2021-4048

EPSS FAQ

0.24%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 47 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-4048

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.4	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:P	10.0	4.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: Partial
9.1	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H	3.9	5.2	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: High

CWE ids for CVE-2021-4048

CWE-125 Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

Assigned by: secalert@redhat.com (Primary)

References for CVE-2021-4048

https://github.com/xianyi/OpenBLAS/commit/2be5ee3cca97a597f2ee2118808a2d5eacea050c

Fix out of bounds read in ?llarv (Reference-LAPACK PR 625) · xianyi/OpenBLAS@2be5ee3 · GitHub
Patch;Third Party Advisory
https://github.com/xianyi/OpenBLAS/commit/fe497efa0510466fd93578aaf9da1ad8ed4edbe7

Fix out of bounds read in ?llarv (Reference-LAPACK PR 625) · xianyi/OpenBLAS@fe497ef · GitHub
Patch;Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6QFEVOCUG2UXMVMFMTU4ONJVDEHY2LW2/

[SECURITY] Fedora 34 Update: lapack-3.9.0-7.fc34 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory
https://github.com/JuliaLang/julia/issues/42415

stegr! call segfault · Issue #42415 · JuliaLang/julia · GitHub
Issue Tracking;Patch;Third Party Advisory
https://github.com/xianyi/OpenBLAS/commit/ddb0ff5353637bb5f5ad060c9620e334c143e3d7

Fix out of bounds read in ?llarv (Reference-LAPACK PR 625) · xianyi/OpenBLAS@ddb0ff5 · GitHub
Patch;Third Party Advisory
https://github.com/Reference-LAPACK/lapack/pull/625

Fix out of bounds read in slarrv by Keno · Pull Request #625 · Reference-LAPACK/lapack · GitHub
Issue Tracking;Patch;Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DROZM4M2QRKSD6FBO4BHSV2QMIRJQPHT/

[SECURITY] Fedora 35 Update: lapack-3.10.0-4.fc35 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory
https://github.com/Reference-LAPACK/lapack/commit/38f3eeee3108b18158409ca2a100e6fe03754781

Merge pull request #625 from JuliaComputing/kf/slarrvbounds · Reference-LAPACK/lapack@38f3eee · GitHub
Patch;Third Party Advisory
https://github.com/xianyi/OpenBLAS/commit/337b65133df174796794871b3988cd03426e6d41

Fix out of bounds read in ?llarv (Reference-LAPACK PR 625) · xianyi/OpenBLAS@337b651 · GitHub
Patch;Third Party Advisory