OpenBLAS contains an out-of-bounds read error in the zlarrv.f library that occurs when user input is not validated properly. This could allow a remote attacker to crash the process associated with the library, or potentially expose the contents of memory by executing arbitrary code. Reference: https://vulndb.cyberriskanalytics.com/vulnerabilities/270365
There's only limited amount of information currently included in this report. Using what's available - file name zlarrv.f and information that the issue should be fixed in openblas 0.3.18 led me to this openblas upstream commit: https://github.com/xianyi/OpenBLAS/commit/337b65133df174796794871b3988cd03426e6d41 This fix is for the lapack library bundled in openblas, and references the following lapack upstream issue and commit: https://github.com/Reference-LAPACK/lapack/pull/625 https://github.com/Reference-LAPACK/lapack/commit/38f3eeee3108b18158409ca2a100e6fe03754781 which points to the original report: https://github.com/JuliaLang/julia/issues/42415 When porting the fix from lapack to openblas, the patch was split to 4 separate commits. In addition to the one listed above for zlarrv.f, other commits are: https://github.com/xianyi/OpenBLAS/commit/2be5ee3cca97a597f2ee2118808a2d5eacea050c https://github.com/xianyi/OpenBLAS/commit/fe497efa0510466fd93578aaf9da1ad8ed4edbe7 https://github.com/xianyi/OpenBLAS/commit/ddb0ff5353637bb5f5ad060c9620e334c143e3d7
There is no released fixed lapack version yet - the current release is 3.10.0 that was released before this fix was made.
The lapack and openblas packages included in Red Hat Enterprise Linux are not widely used by other packages in the distribution. There's no package requiring lapack in Red Hat Enterprise Linux 8. The openblas package in Red Hat Enterprise Linux 8 is only directly required by opencv (which is used by frei0r-plugins and hence gnome-video-effects) and Python numpy and scipy modules (which use openblas in their numpy.linalg and scipy.linalg submodules).
Making this public. Fixes in lapack and openblas have been public since end of Sep / early Oct. Only the VulnDB entry is not publicly visible, but will likely remain restricted to customers of the service.
Created lapack tracking bugs for this issue: Affects: fedora-all [bug 2029851]
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:7639 https://access.redhat.com/errata/RHSA-2022:7639
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-4048
This issue has been addressed in the following products: RHODF-4.14-RHEL-9 Via RHSA-2023:6832 https://access.redhat.com/errata/RHSA-2023:6832