Attestkeep
Language: English
Sign up

Vulnerabilities / CVE-2021-4048

critical

CVE-2021-4048

lapack: Out-of-bounds read in *larrv

Published Modified CWE 125
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Red Hat5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Bitnami9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Julia9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Trivy's own label is CRITICAL. Rated critical by NVD, Bitnami, CBL-Mariner, Julia, Photon OS. Rated lower by Red Hat (medium), AlmaLinux (medium), Amazon (medium), Oracle (medium), Rocky Linux (medium), Ubuntu (low).

Description

An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3.10.0, as also used in OpenBLAS before version 0.3.18. Specially crafted inputs passed to these functions could cause an application using lapack to crash or possibly disclose portions of its memory.

Affected packages and fixed versions

SourcePackageFixed in
bitnami::Bitnami Vulnerability Databaseopenblas0.3.18
CBL-Mariner 1.0lapack0:3.8.0-4.cm1
CBL-Mariner 2.0lapack, openblas0:3.10.0-6.cm2 and 1 more
julia::Julia Ecosystem Security AdvisoriesLAPACK32_jll, LAPACK_jll, MadNLP and 6 more3.10.1+0 and 4 more
Photon OS 2.0lapack3.7.1-1.ph2
Photon OS 3.0lapack3.8.0-2.ph3
Photon OS 4.0lapack, lapack-devel3.9.0-2.ph4
alma 8openblas, openblas-Rblas, openblas-devel and 9 more0.3.15-4.el8
amazon linux 2022blas, blas-devel, blas-static and 7 more3.10.0-4.amzn2022.0.2
debian 10lapack, openblasno fix listed
debian 11lapack, openblasno fix listed
debian 12lapack, openblas3.10.0-2 and 1 more
Show all 143 entries from 23 sources
SourcePackageFixed in
bitnami::Bitnami Vulnerability Databaseopenblas0.3.18
CBL-Mariner 1.0lapack0:3.8.0-4.cm1
CBL-Mariner 2.0lapack0:3.10.0-6.cm2
CBL-Mariner 2.0openblas0:0.3.21-1.cm2
julia::Julia Ecosystem Security AdvisoriesLAPACK32_jll3.10.1+0
julia::Julia Ecosystem Security AdvisoriesLAPACK_jll3.10.1+0
julia::Julia Ecosystem Security AdvisoriesMadNLP0.2.0
julia::Julia Ecosystem Security AdvisoriesMadNLPHSL0.4.0
julia::Julia Ecosystem Security AdvisoriesMadNLPPardisono fix listed
julia::Julia Ecosystem Security AdvisoriesOpenBLAS32_jll0.3.20+0
julia::Julia Ecosystem Security AdvisoriesOpenBLASHighCoreCount_jllno fix listed
julia::Julia Ecosystem Security AdvisoriesOpenBLAS_jll0.3.20+0
julia::Julia Ecosystem Security Advisorieslibjulia_jll1.8.0+1
Photon OS 2.0lapack3.7.1-1.ph2
Photon OS 3.0lapack3.8.0-2.ph3
Photon OS 4.0lapack3.9.0-2.ph4
Photon OS 4.0lapack-devel3.9.0-2.ph4
alma 8openblas0.3.15-4.el8
alma 8openblas-Rblas0.3.15-4.el8
alma 8openblas-devel0.3.15-4.el8
alma 8openblas-openmp0.3.15-4.el8
alma 8openblas-openmp640.3.15-4.el8
alma 8openblas-openmp64_0.3.15-4.el8
alma 8openblas-serial640.3.15-4.el8
alma 8openblas-serial64_0.3.15-4.el8
alma 8openblas-static0.3.15-4.el8
alma 8openblas-threads0.3.15-4.el8
alma 8openblas-threads640.3.15-4.el8
alma 8openblas-threads64_0.3.15-4.el8
amazon linux 2022blas3.10.0-4.amzn2022.0.2
amazon linux 2022blas-devel3.10.0-4.amzn2022.0.2
amazon linux 2022blas-static3.10.0-4.amzn2022.0.2
amazon linux 2022blas643.10.0-4.amzn2022.0.2
amazon linux 2022blas64_3.10.0-4.amzn2022.0.2
amazon linux 2022lapack3.10.0-4.amzn2022.0.2
amazon linux 2022lapack-devel3.10.0-4.amzn2022.0.2
amazon linux 2022lapack-static3.10.0-4.amzn2022.0.2
amazon linux 2022lapack643.10.0-4.amzn2022.0.2
amazon linux 2022lapack64_3.10.0-4.amzn2022.0.2
debian 10lapackno fix listed
debian 10openblasno fix listed
debian 11lapackno fix listed
debian 11openblasno fix listed
debian 12lapack3.10.0-2
debian 12openblas0.3.18+ds-1
debian 13lapack3.10.0-2
debian 13openblas0.3.18+ds-1
debian 14lapack3.10.0-2
debian 14openblas0.3.18+ds-1
debian 9lapackno fix listed
debian 9openblasno fix listed
echolapack3.10.0-2
echoopenblas0.3.18+ds-1
Oracle Linux 8openblas0.3.15-4.el8
Oracle Linux 8openblas-Rblas0.3.15-4.el8
Oracle Linux 8openblas-devel0.3.15-4.el8
Oracle Linux 8openblas-openmp0.3.15-4.el8
Oracle Linux 8openblas-openmp640.3.15-4.el8
Oracle Linux 8openblas-openmp64_0.3.15-4.el8
Oracle Linux 8openblas-serial640.3.15-4.el8
Oracle Linux 8openblas-serial64_0.3.15-4.el8
Oracle Linux 8openblas-static0.3.15-4.el8
Oracle Linux 8openblas-threads0.3.15-4.el8
Oracle Linux 8openblas-threads640.3.15-4.el8
Oracle Linux 8openblas-threads64_0.3.15-4.el8
rapidfort alma 8blasno fix listed
rapidfort alma 8lapackno fix listed
rapidfort alma 9blasno fix listed
rapidfort alma 9lapackno fix listed
Red Hatblasno fix listed
Red Hatblas-develno fix listed
Red Hatblas-staticno fix listed
Red Hatblas64no fix listed
Red Hatblas64-develno fix listed
Red Hatblas64-staticno fix listed
Red Hatblas64_no fix listed
Red Hatcephno fix listed
Red Hatceph-baseno fix listed
Red Hatceph-commonno fix listed
Red Hatceph-fuseno fix listed
Red Hatceph-grafana-dashboardsno fix listed
Red Hatceph-immutable-object-cacheno fix listed
Red Hatceph-mdsno fix listed
Red Hatceph-mgrno fix listed
Red Hatceph-mgr-cephadmno fix listed
Red Hatceph-mgr-dashboardno fix listed
Red Hatceph-mgr-diskprediction-localno fix listed
Red Hatceph-mgr-k8seventsno fix listed
Red Hatceph-mgr-modules-coreno fix listed
Red Hatceph-mgr-rookno fix listed
Red Hatceph-mibno fix listed
Red Hatceph-monno fix listed
Red Hatceph-osdno fix listed
Red Hatceph-prometheus-alertsno fix listed
Red Hatceph-radosgwno fix listed
Red Hatceph-resource-agentsno fix listed
Red Hatceph-selinuxno fix listed
Red Hatceph-testno fix listed
Red Hatcephadmno fix listed
Red Hatcephfs-mirrorno fix listed
Red Hatcephfs-topno fix listed
Red Hatlapackno fix listed
Red Hatlapack-develno fix listed
Red Hatlapack-staticno fix listed
Red Hatlapack64no fix listed
Red Hatlapack64-develno fix listed
Red Hatlapack64-staticno fix listed
Red Hatlapack64_no fix listed
Red Hatlibcephfs-develno fix listed
Red Hatlibcephfs1no fix listed
Red Hatlibcephfs1-develno fix listed
Red Hatlibcephfs2no fix listed
Red Hatlibcephsqliteno fix listed
Red Hatlibrados-develno fix listed
Red Hatlibrados2no fix listed
Red Hatlibrados2-develno fix listed
Red Hatlibradospp-develno fix listed
Red Hatlibradosstriper1no fix listed
Red Hatlibrbd-develno fix listed
Red Hatlibrbd1no fix listed
Red Hatlibrbd1-develno fix listed
Red Hatlibrgw-develno fix listed
Red Hatlibrgw2no fix listed
Red Hatlibrgw2-develno fix listed
Red Hatpython-ceph-argparseno fix listed
Red Hatpython-cephfsno fix listed
Red Hatpython-radosno fix listed
Red Hatpython-rbdno fix listed
Red Hatpython-rgwno fix listed
Red Hatpython3-ceph-argparseno fix listed
Red Hatpython3-ceph-commonno fix listed
Red Hatpython3-cephfsno fix listed
Red Hatpython3-radosno fix listed
Red Hatpython3-rbdno fix listed
Red Hatpython3-rgwno fix listed
Red Hatrbd-mirrorno fix listed
Red Hatrbd-nbdno fix listed
rocky 8openblas0.3.15-4.el8
rocky 8openblas-threads0.3.15-4.el8
ubuntu 18.04-ESMlapackno fix listed
ubuntu 18.04-ESMopenblasno fix listed
ubuntu 20.04-ESMlapackno fix listed
ubuntu 20.04-ESMopenblasno fix listed

References

All 20 references

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.