High severity · published Mar 22, 2023
CVE-2023-28431
Frontier is an Ethereum compatibility layer for Substrate
7.5
CVSS
0.9%
EPSS
No
On KEV
Description
Frontier is an Ethereum compatibility layer for Substrate. Frontier's `modexp` precompile uses `num-bigint` crate under the hood. In the implementation prior to pull request 1017, the cases for modulus being even and modulus being odd are treated separately. Odd modulus uses the fast Montgomery multiplication, and even modulus uses the slow plain power algorithm. This gas cost discrepancy was not accounted for in the `modexp` precompile, leading to possible denial of service attacks.
No fixes for `num-bigint` are currently available, and thus this issue is fixed in the short term by raising the gas costs for even modulus, and in the long term fixing it in `num-bigint` or switching to another modexp implementation. The short-term fix for Frontier is deployed at pull request 1017. There are no known workarounds aside from applying the fix.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FR
Frontier · Parity
before 2023-03-15 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-28431
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-28431
Patch
https://github.com/paritytech/frontier/commit/5af12e94d7dfc8a0208a290643a800f55de7b219
Patch
https://github.com/paritytech/frontier/pull/1017
Vendor Advisory
https://github.com/paritytech/frontier/security/advisories/GHSA-fcmm-54jp-7vf6
Product
https://github.com/rust-num/num-bigint/blob/6f2b8e0fc218dbd0f49bebb8db2d1a771fe6bafa/src/biguint/power.rs#L134
More from Frontier
7.5
CVE-2023-45130
Frontier is Substrate's Ethereum compatibility layer
6.5
CVE-2022-36008
Frontier is Substrate's Ethereum compatibility layer
6.5
CVE-2022-21685
Frontier is Substrate's Ethereum compatibility layer
5.3
CVE-2022-39242
Frontier is an Ethereum compatibility layer for Substrate
5.3
CVE-2022-31111
Frontier is Substrate's Ethereum compatibility layer
