CVE-2021-4048: OpenBLAS Out-of-Bounds Read Vulnerability
Summary
CVE-2021-4048: An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3.10.0, as also used in OpenBLAS before version 0.3.18. Affects openblas versions < 0.3.18. Fixed in 0.3.18. How to fix ↓
Also tracked for
- lapack · Debian:11
The same CVE-2021-4048 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenBLAS is an open-source implementation of the Basic Linear Algebra Subprograms (BLAS) library. It provides optimized mathematical functions for performing linear algebra operations on various architectures. The library is widely used in scientific computing and machine learning applications. However, OpenBLAS versions prior to 0.3.18 are affected by an out-of-bounds read vulnerability in the CLARRV, DLARRV, SLARRV, and ZLARRV functions. This flaw can be exploited by providing specially crafted inputs, leading to application crashes or potential disclosure of sensitive information from memory.
Vulnerability Detail
The out-of-bounds read vulnerability in OpenBLAS arises due to improper input validation in the CLARRV, DLARRV, SLARRV, and ZLARRV functions. When these functions receive maliciously crafted inputs, they may access memory outside the bounds of the allocated buffer. This can result in a crash of the application using OpenBLAS or potentially expose sensitive data from the application's memory. The vulnerability has been assigned the identifier CVE-2021-4048.
How To Fix
Minimum fixed version
0.3.18
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can consider implementing input validation checks in their applications that utilize OpenBLAS. By validating the inputs passed to the CLARRV, DLARRV, SLARRV, and ZLARRV functions, the risk of triggering the out-of-bounds read vulnerability can be mitigated. Here is an example of input validation code in C:
#include <openblas.h>
void myFunction(double* input, int size) {
if (size > 0) {
// Perform input validation
// ...
// Call OpenBLAS function
DLARRV(input, size);
}
}
Conclusion
The out-of-bounds read vulnerability in OpenBLAS can be mitigated by updating to version 0.3.18 or later. Additionally, implementing input validation checks in applications can provide an extra layer of protection. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for openblas →
FAQ
OpenBLAS is an open-source implementation of the Basic Linear Algebra Subprograms (BLAS) library. It provides optimized mathematical functions for performing linear algebra operations on various architectures.
OpenBLAS versions prior to 0.3.18 are affected by this out-of-bounds read vulnerability.
Exploiting this vulnerability can lead to application crashes or potential disclosure of sensitive information from the application's memory.
To fix the vulnerability, update OpenBLAS to version 0.3.18 or later.
Implementing input validation checks in applications that use OpenBLAS can help mitigate the risk of triggering the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for openblas.
