CVE-2023-28431 json
Frontier's modexp precompile is slow for even modulus
published 3y ago modified 4mo ago also GHSA-fcmm-54jp-7vf6 , EUVD-2023-0996
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 59%
- public exploits
- 0
- none known
Summary
Frontier is an Ethereum compatibility layer for Substrate. Frontier's `modexp` precompile uses `num-bigint` crate under the hood. In the implementation prior to pull request 1017, the cases for modulus being even and modulus being odd are treated separately. Odd modulus uses the fast Montgomery multiplication, and even modulus uses the slow plain power algorithm. This gas cost discrepancy was not accounted for in the `modexp` precompile, leading to possible denial of service attacks.
No fixes for `num-bigint` are currently available, and thus this issue is fixed in the short term by raising the gas costs for even modulus, and in the long term fixing it in `num-bigint` or switching to another modexp implementation. The short-term fix for Frontier is deployed at pull request 1017. There are no known workarounds aside from applying the fix.
Patch / fix
- parity frontier 2023-03-15
- github.com/paritytech/frontier@5af12e9 commit
- github.com/paritytech/frontier#1017 pull request
Is CVE-2023-28431 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
0.87% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-14).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | pallet-evm-precompile-modexp | <=1.0.0 |
no fix listed |
Affected products
- paritytech frontier
Classification
- Weakness
-
- CWE-682 Incorrect Calculation
References
-
github.com
/paritytech/frontier/pull/1017
web, patch
-
github.com
/paritytech/frontier/commit/5af12e94d7dfc8a0208a290643a800f55de7b219
web, patch
-
github.com
/paritytech/frontier/security/advisories/GHSA-fcmm-54jp-7vf6
web, vendor-advisory
-
github.com
/rust-num/num-bigint/blob/6f2b8e0fc218dbd0f49bebb8db2d1a771fe6bafa/src/biguint/power.rs#L134
web, product
-
nvd.nist.gov
/vuln/detail/CVE-2023-28431
advisory
-
github.com
/polkadot-evm/frontier
package
Sources
- CVE List CVE-2023-28431
- GitHub Advisory GHSA-fcmm-54jp-7vf6
- NVD CVE-2023-28431
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.