CVE-2021-4048
Severity
9.1CRITICAL
EPSS
0.4%
top 41.56%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedDec 8
Latest updateApr 15
Description
An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3.10.0, as also used in OpenBLAS before version 0.3.18. Specially crafted inputs passed to these functions could cause an application using lapack to crash or possibly disclose portions of its memory.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HExploitability: 3.9 | Impact: 5.2
Affected Packages9 packages
Also affects: Fedora 34, 35, Enterprise Linux 8.0
Patches
🔴Vulnerability Details
3GHSA▶
GHSA-wgf2-cvhg-c384: An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3↗2021-12-09
CVEList▶
CVE-2021-4048: An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3↗2021-12-08
OSV▶
CVE-2021-4048: An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3↗2021-12-08
📋Vendor Advisories
4Microsoft▶
An out-of-bounds read flaw was found in the CLARRV DLARRV SLARRV and ZLARRV functions in lapack through version 3.10.0 as also used in OpenBLAS before version 0.3.18. Specially crafted inputs passed t↗2021-12-14
Debian▶
CVE-2021-4048: lapack - An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV f...↗2021