CVE-2021-4048 Information disclosure in lapack
An out-of-bounds read in LAPACK functions allows attackers to crash applications or disclose memory contents via crafted inputs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-4048?
CVE-2021-4048 is a critical vulnerability in Fedoraproject Fedora, published on 8 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3.10.0, as also used in OpenBLAS before version 0.3.18. Specially crafted inputs passed to these functions could cause an application using lapack to crash or possibly disclose portions of its memory.
Weakness: CWE-125
Which versions are affected by CVE-2021-4048?
1 open source package ship an affected version, including openblas. It affects 8 products.
| Package | Affected | Fixed in |
|---|---|---|
openblas Bitnami | All versions | 0.3.18 |
Linux distribution packages (39)
openblas AlmaLinux:8 | All versions | 0.3.15-4.el8 |
openblas-Rblas AlmaLinux:8 | All versions | 0.3.15-4.el8 |
openblas-devel AlmaLinux:8 | All versions | 0.3.15-4.el8 |
openblas-openmp AlmaLinux:8 | All versions | 0.3.15-4.el8 |
openblas-openmp64 AlmaLinux:8 | All versions | 0.3.15-4.el8 |
openblas-openmp64_ AlmaLinux:8 | All versions | 0.3.15-4.el8 |
openblas-serial64 AlmaLinux:8 | All versions | 0.3.15-4.el8 |
openblas-serial64_ AlmaLinux:8 | All versions | 0.3.15-4.el8 |
openblas-static AlmaLinux:8 | All versions | 0.3.15-4.el8 |
openblas-threads AlmaLinux:8 | All versions | 0.3.15-4.el8 |
openblas-threads64 AlmaLinux:8 | All versions | 0.3.15-4.el8 |
openblas-threads64_ AlmaLinux:8 | All versions | 0.3.15-4.el8 |
openblas Red Hat:enterprise_linux:8::appstream | All versions | 0:0.3.15-4.el8 |
openblas-Rblas-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:0.3.15-4.el8 |
openblas-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:0.3.15-4.el8 |
openblas-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:0.3.15-4.el8 |
openblas-openmp-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:0.3.15-4.el8 |
openblas-openmp64-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:0.3.15-4.el8 |
openblas-openmp64_-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:0.3.15-4.el8 |
openblas-serial64-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:0.3.15-4.el8 |
openblas-serial64_-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:0.3.15-4.el8 |
openblas-threads Red Hat:enterprise_linux:8::appstream | All versions | 0:0.3.15-4.el8 |
openblas-threads-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:0.3.15-4.el8 |
openblas-threads64-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:0.3.15-4.el8 |
openblas-threads64_-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:0.3.15-4.el8 |
openblas-Rblas Red Hat:enterprise_linux:8::crb | All versions | 0:0.3.15-4.el8 |
openblas-Rblas-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:0.3.15-4.el8 |
openblas-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:0.3.15-4.el8 |
openblas-debugsource Red Hat:enterprise_linux:8::crb | All versions | 0:0.3.15-4.el8 |
openblas-devel Red Hat:enterprise_linux:8::crb | All versions | 0:0.3.15-4.el8 |
openblas-openmp Red Hat:enterprise_linux:8::crb | All versions | 0:0.3.15-4.el8 |
openblas-openmp-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:0.3.15-4.el8 |
openblas-openmp64 Red Hat:enterprise_linux:8::crb | All versions | 0:0.3.15-4.el8 |
openblas-openmp64-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:0.3.15-4.el8 |
openblas-openmp64_ Red Hat:enterprise_linux:8::crb | All versions | 0:0.3.15-4.el8 |
openblas-openmp64_-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:0.3.15-4.el8 |
openblas-serial64 Red Hat:enterprise_linux:8::crb | All versions | 0:0.3.15-4.el8 |
openblas-serial64-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:0.3.15-4.el8 |
openblas-serial64_ Red Hat:enterprise_linux:8::crb | All versions | 0:0.3.15-4.el8 |
Products include Fedoraproject Fedora, Julialang Julia, Lapack Project Lapack, Openblas Project Openblas, Redhat Ceph Storage, Redhat Enterprise Linux and 2 more.
How do I fix CVE-2021-4048?
Upgrade openblas to 0.3.18 or later.
Is CVE-2021-4048 being exploited?
There is no known exploitation of CVE-2021-4048 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as ALSA-2022:7639, AZL-6609, AZL-7315, BIT-openblas-2021-4048, CLSA-2026-1784622156, CLSA-2026-1790332295 and 14 more.