CVE-2021-4048
Fixed in a distro release EPSS 3%
An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3.10.0, as also used in OpenBLAS before version 0.3.18. Specially crafted inputs passed to these functions could cause an application using lapack to crash or possibly disclose portions of its memory.
Products: lapack_project lapack, openblas_project openblas, julialang julia, redhat ceph_storage, redhat openshift_container_storage, redhat openshift_data_foundation, redhat enterprise_linux, fedoraproject fedora
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | openblas | 0.3.15-4.el8 |
| AlmaLinux 8 | openblas-Rblas | 0.3.15-4.el8 |
| AlmaLinux 8 | openblas-devel | 0.3.15-4.el8 |
| AlmaLinux 8 | openblas-openmp | 0.3.15-4.el8 |
| AlmaLinux 8 | openblas-openmp64 | 0.3.15-4.el8 |
| AlmaLinux 8 | openblas-openmp64_ | 0.3.15-4.el8 |
| AlmaLinux 8 | openblas-serial64 | 0.3.15-4.el8 |
| AlmaLinux 8 | openblas-serial64_ | 0.3.15-4.el8 |
| AlmaLinux 8 | openblas-static | 0.3.15-4.el8 |
| AlmaLinux 8 | openblas-threads | 0.3.15-4.el8 |
| AlmaLinux 8 | openblas-threads64 | 0.3.15-4.el8 |
| AlmaLinux 8 | openblas-threads64_ | 0.3.15-4.el8 |
| Debian 12 | lapack | 3.10.0-2 |
| Debian 12 | openblas | 0.3.18+ds-1 |
| Debian 13 | lapack | 3.10.0-2 |
| Debian 13 | openblas | 0.3.18+ds-1 |
| Debian 14 | lapack | 3.10.0-2 |
| Debian 14 | openblas | 0.3.18+ds-1 |
| Red Hat Enterprise Linux 8 | openblas | 0:0.3.15-4.el8 |
| Red Hat Enterprise Linux 8 | openblas-Rblas | 0:0.3.15-4.el8 |
| Red Hat Enterprise Linux 8 | openblas-Rblas-debuginfo | 0:0.3.15-4.el8 |
| Red Hat Enterprise Linux 8 | openblas-debuginfo | 0:0.3.15-4.el8 |
| Red Hat Enterprise Linux 8 | openblas-debugsource | 0:0.3.15-4.el8 |
| Red Hat Enterprise Linux 8 | openblas-devel | 0:0.3.15-4.el8 |
| Red Hat Enterprise Linux 8 | openblas-openmp | 0:0.3.15-4.el8 |
| Red Hat Enterprise Linux 8 | openblas-openmp-debuginfo | 0:0.3.15-4.el8 |
| Red Hat Enterprise Linux 8 | openblas-openmp64 | 0:0.3.15-4.el8 |
| Red Hat Enterprise Linux 8 | openblas-openmp64-debuginfo | 0:0.3.15-4.el8 |
| Red Hat Enterprise Linux 8 | openblas-openmp64_ | 0:0.3.15-4.el8 |
| Red Hat Enterprise Linux 8 | openblas-openmp64_-debuginfo | 0:0.3.15-4.el8 |
| Red Hat Enterprise Linux 8 | openblas-serial64 | 0:0.3.15-4.el8 |
| Red Hat Enterprise Linux 8 | openblas-serial64-debuginfo | 0:0.3.15-4.el8 |
| Red Hat Enterprise Linux 8 | openblas-serial64_ | 0:0.3.15-4.el8 |
| Red Hat Enterprise Linux 8 | openblas-serial64_-debuginfo | 0:0.3.15-4.el8 |
| Red Hat Enterprise Linux 8 | openblas-static | 0:0.3.15-4.el8 |
| Red Hat Enterprise Linux 8 | openblas-threads | 0:0.3.15-4.el8 |
| Red Hat Enterprise Linux 8 | openblas-threads-debuginfo | 0:0.3.15-4.el8 |
| Red Hat Enterprise Linux 8 | openblas-threads64 | 0:0.3.15-4.el8 |
| Red Hat Enterprise Linux 8 | openblas-threads64-debuginfo | 0:0.3.15-4.el8 |
| Red Hat Enterprise Linux 8 | openblas-threads64_ | 0:0.3.15-4.el8 |
| Red Hat Enterprise Linux 8 | openblas-threads64_-debuginfo | 0:0.3.15-4.el8 |
| Rocky Linux 8 | openblas | 0:0.3.15-4.el8 |
| SUSE Linux Enterprise Module for Basesystem 15 SP3 | lapack | 3.5.0-4.6.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP3 | lapack | 3.5.0-4.6.1 |
| SUSE Linux Enterprise Real Time 15 SP2 | lapack | 3.5.0-4.6.1 |
| SUSE Linux Enterprise Server 12 SP5 | lapack | 3.5.0-3.9.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | lapack | 3.5.0-3.9.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP5 | lapack | 3.5.0-3.9.1 |
| Ubuntu 14.04 LTS | openblas | no fix |
| Ubuntu 16.04 LTS | openblas | no fix |
| Ubuntu 18.04 LTS | lapack | no fix |
| Ubuntu 18.04 LTS | openblas | no fix |
| Ubuntu 20.04 LTS | lapack | no fix |
| Ubuntu 20.04 LTS | openblas | no fix |
| openSUSE Leap 15.3 | lapack | 3.5.0-4.6.1 |
| openSUSE Leap 15.3 | lapack-man | 3.5.0-4.6.1 |