CVE-2021-4048: fedoraproject fedora Out-of-bounds Read
CVSS: 9.1v3.1CriticalModified
AliasesMGASA-2021-0586SUSE-SU-2022:0913-1SUSE-SU-2022:0915-1RHSA-2022:7639UBUNTU-CVE-2021-4048DEBIAN-CVE-2021-4048openSUSE-SU-2022:0915-1
Published 08-12-2021Last modified 03-08-2024
Vulnerability summary
CVE-2021-4048 is a critical (CVSS 9.1) Out-of-bounds Read vulnerability in fedoraproject fedora. EPSS estimates a 2.76% chance of exploitation in the next 30 days, higher than 86% of scored vulnerabilities.
CVSS score
9.1/10
010
Critical · v3.1 (NVD)EPSS score
2.76%
0%100%
Low · +0.19 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 08-12-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3.10.0, as also used in OpenBLAS before version 0.3.18. Specially crafted inputs passed to these functions could cause an application using lapack to crash or possibly disclose portions of its memory.
CVSS metrics
5 scores · 4 sources · 2 versionsCritical 9.1Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HSources4 sources · 5.9–9.1
- OSV · Red hatEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- OSV · DebianEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Medium 6.4Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:N/A:PSourcesSingle source
EPSS trend
Probability
2.76%
Chance of exploitation in the next 30 days
Percentile
86%
Versus all other CVEs
30-day change
+0.19 pp
From 2.57% on 19-09-2026
19-09-202619-10-2026
EPSS score2.76%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat27 products
- ceph_storage2.0 | 3.0 | 4.0 | 5.0
- enterprise_linux8.0
- openshift_container_storage4.0
- openshift_data_foundation4.0
- openblas< 0:0.3.15-4.el8
Suse6 products
- lapack&distro=SUSE Linux Enterprise Module for Basesystem 15 SP3< 3.5.0-4.6.1
- lapack&distro=SUSE Linux Enterprise Module for Development Tools 15 SP3< 3.5.0-4.6.1
- lapack&distro=SUSE Linux Enterprise Real Time 15 SP2< 3.5.0-4.6.1
- lapack&distro=SUSE Linux Enterprise Server 12 SP5< 3.5.0-3.9.1
- lapack&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 3.5.0-3.9.1
Debian2 products
- lapack< 3.10.0-2
- openblas< 0.3.18+ds-1
Mageia2 products
- lapack< 3.9.0-3.1.mga8
- openblas< 0.3.12-4.1.mga8
Opensuse2 products
- lapack-man&distro=openSUSE Leap 15.3< 3.5.0-4.6.1
- lapack&distro=openSUSE Leap 15.3< 3.5.0-4.6.1
Ubuntu2 products
- lapackAll versions (No fix recorded)
- openblasAll versions (No fix recorded)
Fedoraproject1 product
- fedoraEOL34 | 35
Julialang1 product
- julia≤ 1.6.3 | 1.7.0:beta1 | 1.7.0:beta2 | 1.7.0:beta3 | 1.7.0:beta4 | 1.7.0:rc1
Lapack_project1 product
- lapack≤ 3.10.0
Openblas_project1 product
- openblas< 0.3.18
10 vendors · 45 products
References
27 links- github.com/Reference-LAPACK/lapack/commit/38f3eeee3108b18158409ca2a100e6fe03754781X Refsource MISCPatchThird Party Advisory
- github.com/xianyi/OpenBLAS/commit/337b65133df174796794871b3988cd03426e6d41X Refsource MISCPatchThird Party Advisory
- github.com/xianyi/OpenBLAS/commit/2be5ee3cca97a597f2ee2118808a2d5eacea050cX Refsource MISCPatchThird Party Advisory
- github.com/xianyi/OpenBLAS/commit/fe497efa0510466fd93578aaf9da1ad8ed4edbe7X Refsource MISCPatchThird Party Advisory
- github.com/xianyi/OpenBLAS/commit/ddb0ff5353637bb5f5ad060c9620e334c143e3d7X Refsource MISCPatchThird Party Advisory
Show all 27 references
- lists.opensuse.org/archives/…Advisory