PT-2021-22895 · Openblas+10 · Openblas+10

Martin-Frbg · Published 2021-09-28 · Updated 2025-04-24 · CVE-2021-4048

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions lapack versions 3.10.0 and earlier OpenBLAS versions 0.3.18 and earlier

Description An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions. Specially crafted inputs passed to these functions could cause an application using lapack to crash or possibly disclose portions of its memory.

Recommendations For lapack versions 3.10.0 and earlier, update to a version later than 3.10.0. For OpenBLAS versions 0.3.18 and earlier, update to a version later than 0.3.18. As a temporary workaround, consider disabling the CLARRV, DLARRV, SLARRV, and ZLARRV functions until a patch is available.

Fix

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALSA-2022:7639

ALT-PU-2021-3562

ALT-PU-2022-2457

ALT-PU-2024-4379

ALT-PU-2025-4856

ALT-PU-2025-4858

AZL-6609

AZL-7315

BDU:2025-03980

BIT-OPENBLAS-2021-4048

CESA-2022_7639

CVE-2021-4048

MGASA-2021-0586

OESA-2021-1471

OESA-2021-1478

OESA-2022-1947

OPENSUSE-SU-2022:0915-1

OPENSUSE-SU-2022_0915-1

OPENSUSE-SU-2024:11704-1

RHSA-2022:7639

RHSA-2022_7639

RLSA-2022:7639

SUSE-SU-2022:0913-1

SUSE-SU-2022:0915-1

SUSE-SU-2022_0913-1

SUSE-SU-2022_0915-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Debian

Openblas

Red Hat

Red Os

Rocky Linux

Suse

Lapack

References · 56

• https://github.com/JuliaLang/julia/issues/42415 · Patch
• https://github.com/xianyi/OpenBLAS/commit/ddb0ff5353637bb5f5ad060c9620e334c143e3d7 · Patch
• https://github.com/xianyi/OpenBLAS/commit/2be5ee3cca97a597f2ee2118808a2d5eacea050c · Patch
• https://github.com/xianyi/OpenBLAS/commit/337b65133df174796794871b3988cd03426e6d41 · Patch
• https://github.com/xianyi/OpenBLAS/commit/fe497efa0510466fd93578aaf9da1ad8ed4edbe7 · Patch
• https://github.com/Reference-LAPACK/lapack/commit/38f3eeee3108b18158409ca2a100e6fe03754781 · Patch
• https://github.com/Reference-LAPACK/lapack/pull/625 · Patch
• https://osv.dev/vulnerability/MGASA-2021-0586 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DROZM4M2QRKSD6FBO4BHSV2QMIRJQPHT · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-4048 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2022-7639.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:0915-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-0319SE17 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-4048 · Security Note
• https://osv.dev/vulnerability/AZL-7315 · Vendor Advisory