by Kastro
Paper/Archive/CVE-2021-4048

CVE-2021-4048

redhat — An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3.10.0, as also used i…

EPSS 3%CVSS 9.1
critical.is priorityof 100
45
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 86.3.863 × 2017.3No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3.10.0, as also used in OpenBLAS before version 0.3.18. Specially crafted inputs passed to these functions could cause an application using lapack to crash or possibly disclose portions of its memory.

Affected

ProductAffectedFixed inSource
lapacklapack through version 3.10.0–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

References

refgithub.com/Reference-LAPACK/lapack/pull/625refgithub.com/Reference-LAPACK/lapack/commit/38f3eeee3108b18158409ca2a100e6fe03754781refgithub.com/JuliaLang/julia/issues/42415refgithub.com/xianyi/OpenBLAS/commit/337b65133df174796794871b3988cd03426e6d41refgithub.com/xianyi/OpenBLAS/commit/2be5ee3cca97a597f2ee2118808a2d5eacea050crefgithub.com/xianyi/OpenBLAS/commit/fe497efa0510466fd93578aaf9da1ad8ed4edbe7refgithub.com/xianyi/OpenBLAS/commit/ddb0ff5353637bb5f5ad060c9620e334c143e3d7advisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DROZM4M2QRKSD6FBO4BHSV2QMIRJQPHTadvisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QFEVOCUG2UXMVMFMTU4ONJVDEHY2LW2