CVE-2021-4048

An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3.10.0, as also used in OpenBLAS before version 0.3.18. Specially crafted inputs passed to these functions could cause an application using lapack to crash or possibly disclose portions of its memory.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.1 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 58%
Affected Products (NVD)
VendorProductVersion
lapack_projectlapack
𝑥
≤ 3.10.0
openblas_projectopenblas
𝑥
< 0.3.18
julialangjulia
𝑥
≤ 1.6.3
julialangjulia
1.7.0:beta1
julialangjulia
1.7.0:beta2
julialangjulia
1.7.0:beta3
julialangjulia
1.7.0:beta4
julialangjulia
1.7.0:rc1
redhatceph_storage
2.0
redhatceph_storage
3.0
redhatceph_storage
4.0
redhatceph_storage
5.0
redhatopenshift_container_storage
4.0
redhatopenshift_data_foundation
4.0
redhatenterprise_linux
8.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
lapack
bookworm
3.11.0-2
fixed
bullseye
no-dsa
buster
no-dsa
sid
3.12.0-3
fixed
stretch
no-dsa
trixie
3.12.0-3
fixed
openblas
bookworm
0.3.21+ds-4
fixed
bullseye
no-dsa
buster
no-dsa
sid
0.3.28+ds-2
fixed
stretch
no-dsa
trixie
0.3.28+ds-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
lapack
bionic
needed
focal
needed
hirsute
ignored
impish
ignored
jammy
not-affected
kinetic
not-affected
lunar
not-affected
mantic
not-affected
noble
not-affected
trusty
ignored
xenial
not-affected
openblas
bionic
needed
focal
needed
hirsute
ignored
impish
ignored
jammy
not-affected
kinetic
not-affected
lunar
not-affected
mantic
not-affected
noble
not-affected
trusty
needs-triage
xenial
needs-triage
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
blas-devel
suse enterprise desktop 15 SP3
3.5.0-4.6.1
fixed
suse enterprise desktop 15 SP4
3.5.0-4.6.1
fixed
suse enterprise desktop 15 SP5
3.5.0-4.6.1
fixed
suse enterprise desktop 15 SP6
3.5.0-4.6.1
fixed
suse enterprise desktop 15 SP7
3.5.0-4.6.1
fixed
suse enterprise sap 15 SP3
3.5.0-4.6.1
fixed
suse enterprise sap 15 SP4
3.5.0-4.6.1
fixed
suse enterprise sap 15 SP5
3.5.0-4.6.1
fixed
suse enterprise sap 15 SP6
3.5.0-4.6.1
fixed
suse enterprise sap 15 SP7
3.5.0-4.6.1
fixed
suse enterprise server 15 SP3
3.5.0-4.6.1
fixed
suse enterprise server 15 SP4
3.5.0-4.6.1
fixed
suse enterprise server 15 SP5
3.5.0-4.6.1
fixed
suse enterprise server 15 SP6
3.5.0-4.6.1
fixed
suse enterprise server 15 SP7
3.5.0-4.6.1
fixed
cblas-devel
suse enterprise desktop 15 SP5
3.9.0-150000.4.13.2
fixed
suse enterprise desktop 15 SP6
3.9.0-150000.4.13.2
fixed
suse enterprise desktop 15 SP7
3.9.0-150000.4.13.2
fixed
suse enterprise sap 15 SP5
3.9.0-150000.4.13.2
fixed
suse enterprise sap 15 SP6
3.9.0-150000.4.13.2
fixed
suse enterprise sap 15 SP7
3.9.0-150000.4.13.2
fixed
suse enterprise server 15 SP5
3.9.0-150000.4.13.2
fixed
suse enterprise server 15 SP6
3.9.0-150000.4.13.2
fixed
suse enterprise server 15 SP7
3.9.0-150000.4.13.2
fixed
lapack-devel
suse enterprise desktop 15 SP3
3.5.0-4.6.1
fixed
suse enterprise desktop 15 SP4
3.5.0-4.6.1
fixed
suse enterprise desktop 15 SP5
3.5.0-4.6.1
fixed
suse enterprise desktop 15 SP6
3.5.0-4.6.1
fixed
suse enterprise desktop 15 SP7
3.5.0-4.6.1
fixed
suse enterprise sap 15 SP3
3.5.0-4.6.1
fixed
suse enterprise sap 15 SP4
3.5.0-4.6.1
fixed
suse enterprise sap 15 SP5
3.5.0-4.6.1
fixed
suse enterprise sap 15 SP6
3.5.0-4.6.1
fixed
suse enterprise sap 15 SP7
3.5.0-4.6.1
fixed
suse enterprise server 15 SP3
3.5.0-4.6.1
fixed
suse enterprise server 15 SP4
3.5.0-4.6.1
fixed
suse enterprise server 15 SP5
3.5.0-4.6.1
fixed
suse enterprise server 15 SP6
3.5.0-4.6.1
fixed
suse enterprise server 15 SP7
3.5.0-4.6.1
fixed
lapacke-devel
suse enterprise desktop 15 SP5
3.5.0-4.6.1
fixed
suse enterprise desktop 15 SP6
3.5.0-4.6.1
fixed
suse enterprise desktop 15 SP7
3.5.0-4.6.1
fixed
suse enterprise sap 15 SP5
3.5.0-4.6.1
fixed
suse enterprise sap 15 SP6
3.5.0-4.6.1
fixed
suse enterprise sap 15 SP7
3.5.0-4.6.1
fixed
suse enterprise server 15 SP5
3.5.0-4.6.1
fixed
suse enterprise server 15 SP6
3.5.0-4.6.1
fixed
suse enterprise server 15 SP7
3.5.0-4.6.1
fixed
libblas3
suse enterprise desktop 15 SP3
3.5.0-4.6.1
fixed
suse enterprise desktop 15 SP4
3.5.0-4.6.1
fixed
suse enterprise desktop 15 SP5
3.5.0-4.6.1
fixed
suse enterprise desktop 15 SP6
3.5.0-4.6.1
fixed
suse enterprise desktop 15 SP7
3.5.0-4.6.1
fixed
suse enterprise sap 12 SP5
3.5.0-3.9.1
fixed
suse enterprise sap 15 SP3
3.5.0-4.6.1
fixed
suse enterprise sap 15 SP4
3.5.0-4.6.1
fixed
suse enterprise sap 15 SP5
3.5.0-4.6.1
fixed
suse enterprise sap 15 SP6
3.5.0-4.6.1
fixed
suse enterprise sap 15 SP7
3.5.0-4.6.1
fixed
suse enterprise server 12 SP3
3.5.0-3.9.1
fixed
suse enterprise server 12 SP5
3.5.0-3.9.1
fixed
suse enterprise server 15 SP3
3.5.0-4.6.1
fixed
suse enterprise server 15 SP4
3.5.0-4.6.1
fixed
suse enterprise server 15 SP5
3.5.0-4.6.1
fixed
suse enterprise server 15 SP6
3.5.0-4.6.1
fixed
suse enterprise server 15 SP7
3.5.0-4.6.1
fixed
libcblas3
suse enterprise desktop 15 SP5
3.9.0-150000.4.13.2
fixed
suse enterprise desktop 15 SP6
3.9.0-150000.4.13.2
fixed
suse enterprise desktop 15 SP7
3.9.0-150000.4.13.2
fixed
suse enterprise sap 15 SP5
3.9.0-150000.4.13.2
fixed
suse enterprise sap 15 SP6
3.9.0-150000.4.13.2
fixed
suse enterprise sap 15 SP7
3.9.0-150000.4.13.2
fixed
suse enterprise server 15 SP5
3.9.0-150000.4.13.2
fixed
suse enterprise server 15 SP6
3.9.0-150000.4.13.2
fixed
suse enterprise server 15 SP7
3.9.0-150000.4.13.2
fixed
liblapack3
suse enterprise desktop 15 SP3
3.5.0-4.6.1
fixed
suse enterprise desktop 15 SP4
3.5.0-4.6.1
fixed
suse enterprise desktop 15 SP5
3.5.0-4.6.1
fixed
suse enterprise desktop 15 SP6
3.5.0-4.6.1
fixed
suse enterprise desktop 15 SP7
3.5.0-4.6.1
fixed
suse enterprise sap 12 SP5
3.5.0-3.9.1
fixed
suse enterprise sap 15 SP3
3.5.0-4.6.1
fixed
suse enterprise sap 15 SP4
3.5.0-4.6.1
fixed
suse enterprise sap 15 SP5
3.5.0-4.6.1
fixed
suse enterprise sap 15 SP6
3.5.0-4.6.1
fixed
suse enterprise sap 15 SP7
3.5.0-4.6.1
fixed
suse enterprise server 12 SP3
3.5.0-3.9.1
fixed
suse enterprise server 12 SP5
3.5.0-3.9.1
fixed
suse enterprise server 15 SP3
3.5.0-4.6.1
fixed
suse enterprise server 15 SP4
3.5.0-4.6.1
fixed
suse enterprise server 15 SP5
3.5.0-4.6.1
fixed
suse enterprise server 15 SP6
3.5.0-4.6.1
fixed
suse enterprise server 15 SP7
3.5.0-4.6.1
fixed
liblapacke3
suse enterprise desktop 15 SP5
3.5.0-4.6.1
fixed
suse enterprise desktop 15 SP6
3.5.0-4.6.1
fixed
suse enterprise desktop 15 SP7
3.5.0-4.6.1
fixed
suse enterprise sap 15 SP5
3.5.0-4.6.1
fixed
suse enterprise sap 15 SP6
3.5.0-4.6.1
fixed
suse enterprise sap 15 SP7
3.5.0-4.6.1
fixed
suse enterprise server 15 SP5
3.5.0-4.6.1
fixed
suse enterprise server 15 SP6
3.5.0-4.6.1
fixed
suse enterprise server 15 SP7
3.5.0-4.6.1
fixed
libopenblas_openmp-devel
suse enterprise desktop 15 SP4
0.3.20-150400.2.3
fixed
suse enterprise desktop 15 SP5
0.3.21-150500.2.6
fixed
suse enterprise desktop 15 SP6
0.3.25-150500.4.5.2
fixed
suse enterprise desktop 15 SP7
0.3.28-150700.3.4
fixed
suse enterprise sap 15 SP4
0.3.20-150400.2.3
fixed
suse enterprise sap 15 SP5
0.3.21-150500.2.6
fixed
suse enterprise sap 15 SP6
0.3.25-150500.4.5.2
fixed
suse enterprise sap 15 SP7
0.3.28-150700.3.4
fixed
suse enterprise server 15 SP4
0.3.20-150400.2.3
fixed
suse enterprise server 15 SP5
0.3.21-150500.2.6
fixed
suse enterprise server 15 SP6
0.3.25-150500.4.5.2
fixed
suse enterprise server 15 SP7
0.3.28-150700.3.4
fixed
libopenblas_openmp0
suse enterprise desktop 15 SP4
0.3.20-150400.2.3
fixed
suse enterprise desktop 15 SP5
0.3.21-150500.2.6
fixed
suse enterprise desktop 15 SP6
0.3.25-150500.4.5.2
fixed
suse enterprise desktop 15 SP7
0.3.28-150700.3.4
fixed
suse enterprise sap 15 SP4
0.3.20-150400.2.3
fixed
suse enterprise sap 15 SP5
0.3.21-150500.2.6
fixed
suse enterprise sap 15 SP6
0.3.25-150500.4.5.2
fixed
suse enterprise sap 15 SP7
0.3.28-150700.3.4
fixed
suse enterprise server 15 SP4
0.3.20-150400.2.3
fixed
suse enterprise server 15 SP5
0.3.21-150500.2.6
fixed
suse enterprise server 15 SP6
0.3.25-150500.4.5.2
fixed
suse enterprise server 15 SP7
0.3.28-150700.3.4
fixed
libopenblas_pthreads-devel
suse enterprise desktop 15 SP4
0.3.20-150400.2.3
fixed
suse enterprise desktop 15 SP5
0.3.21-150500.2.6
fixed
suse enterprise desktop 15 SP6
0.3.25-150500.4.5.2
fixed
suse enterprise desktop 15 SP7
0.3.28-150700.3.4
fixed
suse enterprise sap 15 SP4
0.3.20-150400.2.3
fixed
suse enterprise sap 15 SP5
0.3.21-150500.2.6
fixed
suse enterprise sap 15 SP6
0.3.25-150500.4.5.2
fixed
suse enterprise sap 15 SP7
0.3.28-150700.3.4
fixed
suse enterprise server 15 SP4
0.3.20-150400.2.3
fixed
suse enterprise server 15 SP5
0.3.21-150500.2.6
fixed
suse enterprise server 15 SP6
0.3.25-150500.4.5.2
fixed
suse enterprise server 15 SP7
0.3.28-150700.3.4
fixed
libopenblas_pthreads0
suse enterprise desktop 15 SP4
0.3.20-150400.2.3
fixed
suse enterprise desktop 15 SP5
0.3.21-150500.2.6
fixed
suse enterprise desktop 15 SP6
0.3.25-150500.4.5.2
fixed
suse enterprise desktop 15 SP7
0.3.28-150700.3.4
fixed
suse enterprise sap 15 SP4
0.3.20-150400.2.3
fixed
suse enterprise sap 15 SP5
0.3.21-150500.2.6
fixed
suse enterprise sap 15 SP6
0.3.25-150500.4.5.2
fixed
suse enterprise sap 15 SP7
0.3.28-150700.3.4
fixed
suse enterprise server 15 SP4
0.3.20-150400.2.3
fixed
suse enterprise server 15 SP5
0.3.21-150500.2.6
fixed
suse enterprise server 15 SP6
0.3.25-150500.4.5.2
fixed
suse enterprise server 15 SP7
0.3.28-150700.3.4
fixed
openblas-common-devel
suse enterprise desktop 15 SP4
0.3.20-150400.2.3
fixed
suse enterprise desktop 15 SP5
0.3.21-150500.2.6
fixed
suse enterprise desktop 15 SP6
0.3.25-150500.4.5.1
fixed
suse enterprise desktop 15 SP7
0.3.28-150700.3.2
fixed
suse enterprise sap 15 SP4
0.3.20-150400.2.3
fixed
suse enterprise sap 15 SP5
0.3.21-150500.2.6
fixed
suse enterprise sap 15 SP6
0.3.25-150500.4.5.1
fixed
suse enterprise sap 15 SP7
0.3.28-150700.3.2
fixed
suse enterprise server 15 SP4
0.3.20-150400.2.3
fixed
suse enterprise server 15 SP5
0.3.21-150500.2.6
fixed
suse enterprise server 15 SP6
0.3.25-150500.4.5.1
fixed
suse enterprise server 15 SP7
0.3.28-150700.3.2
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
openblas
RHEL 8
0:0.3.15-4.el8
fixed
openblas-Rblas
RHEL 8
0:0.3.15-4.el8
fixed
openblas-devel
RHEL 8
0:0.3.15-4.el8
fixed
openblas-openmp
RHEL 8
0:0.3.15-4.el8
fixed
openblas-openmp64
RHEL 8
0:0.3.15-4.el8
fixed
openblas-serial64
RHEL 8
0:0.3.15-4.el8
fixed
openblas-static
RHEL 8
0:0.3.15-4.el8
fixed
openblas-threads
RHEL 8
0:0.3.15-4.el8
fixed
openblas-threads64
RHEL 8
0:0.3.15-4.el8
fixed
Common Weakness Enumeration
References
https://github.com/JuliaLang/julia/issues/42415
https://github.com/Reference-LAPACK/lapack/commit/38f3eeee3108b18158409ca2a100e6fe03754781
https://github.com/Reference-LAPACK/lapack/pull/625
https://github.com/xianyi/OpenBLAS/commit/2be5ee3cca97a597f2ee2118808a2d5eacea050c
https://github.com/xianyi/OpenBLAS/commit/337b65133df174796794871b3988cd03426e6d41
https://github.com/xianyi/OpenBLAS/commit/ddb0ff5353637bb5f5ad060c9620e334c143e3d7
https://github.com/xianyi/OpenBLAS/commit/fe497efa0510466fd93578aaf9da1ad8ed4edbe7
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QFEVOCUG2UXMVMFMTU4ONJVDEHY2LW2/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DROZM4M2QRKSD6FBO4BHSV2QMIRJQPHT/
https://github.com/JuliaLang/julia/issues/42415
https://github.com/Reference-LAPACK/lapack/commit/38f3eeee3108b18158409ca2a100e6fe03754781
https://github.com/Reference-LAPACK/lapack/pull/625
https://github.com/xianyi/OpenBLAS/commit/2be5ee3cca97a597f2ee2118808a2d5eacea050c
https://github.com/xianyi/OpenBLAS/commit/337b65133df174796794871b3988cd03426e6d41
https://github.com/xianyi/OpenBLAS/commit/ddb0ff5353637bb5f5ad060c9620e334c143e3d7
https://github.com/xianyi/OpenBLAS/commit/fe497efa0510466fd93578aaf9da1ad8ed4edbe7
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QFEVOCUG2UXMVMFMTU4ONJVDEHY2LW2/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DROZM4M2QRKSD6FBO4BHSV2QMIRJQPHT/