← back
CVE-2021-4048

CVE-2021-4048

EPSS 2.6%CWE-125
Vexday Risk Score
3Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS —EPSS 2.6%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado
Lifecycle
08 Dec 2021Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3.10.0, as also used in OpenBLAS before version 0.3.18. Specially crafted inputs passed to these functions could cause an application using lapack to crash or possibly disclose portions of its memory.
Affected products
n/a · lapack

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://github.com/JuliaLang/julia/issues/42415https://github.com/Reference-LAPACK/lapack/commit/38f3eeee3108b18158409ca2a100e6fe03754781https://github.com/Reference-LAPACK/lapack/pull/625https://github.com/xianyi/OpenBLAS/commit/2be5ee3cca97a597f2ee2118808a2d5eacea050chttps://github.com/xianyi/OpenBLAS/commit/337b65133df174796794871b3988cd03426e6d41https://github.com/xianyi/OpenBLAS/commit/ddb0ff5353637bb5f5ad060c9620e334c143e3d7https://github.com/xianyi/OpenBLAS/commit/fe497efa0510466fd93578aaf9da1ad8ed4edbe7https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QFEVOCUG2UXMVMFMTU4ONJVDEHY2LW2/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DROZM4M2QRKSD6FBO4BHSV2QMIRJQPHT/