CVE-2021-4048 (published 2021-12-08T22:15Z)

An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3.10.0, as also used in OpenBLAS before version 0.3.18. Specially crafted inputs passed to these functions could cause an application using lapack to crash or possibly disclose portions of its memory.

Severity: MEDIUM
CVSS v2 base score: 6.4 (AV:N/AC:L/Au:N/C:P/I:N/A:P)
CVSS v3 base score: 9.1, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/xianyi/OpenBLAS
commit_details: repo_url: https://github.com/xianyi/OpenBLAS
author: Martin Kroeker
author_date: 2021-10-01 11:19:53+02:00
msg: Fix out of bounds read in ?llarv (Reference-LAPACK PR 625)
repository: repo_url: https://github.com/xianyi/OpenBLAS
repo_name: OpenMathLib/OpenBLAS
description: OpenBLAS is an optimized BLAS library based on GotoBLAS2 1.13 BSD version. 
repo_language: C
owner: xianyi
file_changes: filename: zlarrv.f
change_type: ModificationType.MODIFY
diff: @@ -351,7 +351,7 @@
 *
 *     Quick return if possible
 *
-      IF( N.LE.0 ) THEN
+      IF( (N.LE.0).OR.(M.LE.0) ) THEN
          RETURN
       END IF
 *

programming_language: Markdown
repo_url: https://github.com/xianyi/OpenBLAS
commit_details: repo_url: https://github.com/xianyi/OpenBLAS
author: Martin Kroeker
author_date: 2021-10-01 11:17:21+02:00
msg: Fix out of bounds read in ?llarv (Reference-LAPACK PR 625)
repository: repo_url: https://github.com/xianyi/OpenBLAS
repo_name: OpenMathLib/OpenBLAS
description: OpenBLAS is an optimized BLAS library based on GotoBLAS2 1.13 BSD version. 
repo_language: C
owner: xianyi
file_changes: filename: clarrv.f
change_type: ModificationType.MODIFY
diff: @@ -351,7 +351,7 @@
 *
 *     Quick return if possible
 *
-      IF( N.LE.0 ) THEN
+      IF( (N.LE.0) .OR. (M.LE.0) ) THEN
          RETURN
       END IF
 *

programming_language: Markdown
repo_url: https://github.com/xianyi/OpenBLAS
commit_details: repo_url: https://github.com/xianyi/OpenBLAS
author: Martin Kroeker
author_date: 2021-10-01 11:19:07+02:00
msg: Fix out of bounds read in ?llarv (Reference-LAPACK PR 625)
repository: repo_url: https://github.com/xianyi/OpenBLAS
repo_name: OpenMathLib/OpenBLAS
description: OpenBLAS is an optimized BLAS library based on GotoBLAS2 1.13 BSD version. 
repo_language: C
owner: xianyi
file_changes: filename: slarrv.f
change_type: ModificationType.MODIFY
diff: @@ -353,7 +353,7 @@
 *
 *     Quick return if possible
 *
-      IF( N.LE.0 ) THEN
+      IF( (N.LE.0).OR.(M.LE.0) ) THEN
          RETURN
       END IF
 *

programming_language: Markdown
repo_url: https://github.com/Reference-LAPACK/lapack
commit_details: repo_url: https://github.com/Reference-LAPACK/lapack
author: Weslley S. Pereira
author_date: 2021-10-01 08:27:02-06:00
msg: Merge pull request #625 from JuliaComputing/kf/slarrvbounds

Thank you!
repository: repo_url: https://github.com/Reference-LAPACK/lapack
repo_name: Reference-LAPACK/lapack
description: LAPACK development repository
repo_language: Fortran
owner: Reference-LAPACK
repo_url: https://github.com/xianyi/OpenBLAS
commit_details: repo_url: https://github.com/xianyi/OpenBLAS
author: Martin Kroeker
author_date: 2021-10-01 11:18:20+02:00
msg: Fix out of bounds read in ?llarv (Reference-LAPACK PR 625)
repository: repo_url: https://github.com/xianyi/OpenBLAS
repo_name: OpenMathLib/OpenBLAS
description: OpenBLAS is an optimized BLAS library based on GotoBLAS2 1.13 BSD version. 
repo_language: C
owner: xianyi
file_changes: filename: dlarrv.f
change_type: ModificationType.MODIFY
diff: @@ -353,7 +353,7 @@
 *
 *     Quick return if possible
 *
-      IF( N.LE.0 ) THEN
+      IF( (N.LE.0).OR.(M.LE.0) ) THEN
          RETURN
       END IF
 *

programming_language: Markdown