CVE-2023-28431 json
Frontier's modexp precompile is slow for even modulus
published 2023-03-21 3 y ago modified 2026-06-17 4 mo ago also GHSA-fcmm-54jp-7vf6 , EUVD-2023-0996
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 59%
- public exploits
- 0
- none known
Summary
Frontier is an Ethereum compatibility layer for Substrate. Frontier's `modexp` precompile uses `num-bigint` crate under the hood. In the implementation prior to pull request 1017, the cases for modulus being even and modulus being odd are treated separately. Odd modulus uses the fast Montgomery multiplication, and even modulus uses the slow plain power algorithm. This gas cost discrepancy was not accounted for in the `modexp` precompile, leading to possible denial of service attacks.
No fixes for `num-bigint` are currently available, and thus this issue is fixed in the short term by raising the gas costs for even modulus, and in the long term fixing it in `num-bigint` or switching to another modexp implementation. The short-term fix for Frontier is deployed at pull request 1017. There are no known workarounds aside from applying the fix.
Patch / fix
- parity frontier 2023-03-15
- github.com/paritytech/frontier@5af12e9 commit
- github.com/paritytech/frontier#1017 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 20 mo ago
Exploit prediction
0.87% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | pallet-evm-precompile-modexp | <=1.0.0 |
no fix listed |
Affected products
- paritytech frontier
Classification
- Weakness
-
- CWE-682 Incorrect Calculation
References
-
github.com
/paritytech/frontier/pull/1017
web, patch
-
github.com
/paritytech/frontier/commit/5af12e94d7dfc8a0208a290643a800f55de7b219
web, patch
-
github.com
/paritytech/frontier/security/advisories/GHSA-fcmm-54jp-7vf6
web, vendor-advisory
-
github.com
/rust-num/num-bigint/blob/6f2b8e0fc218dbd0f49bebb8db2d1a771fe6bafa/src/biguint/power.rs#L134
web, product
-
nvd.nist.gov
/vuln/detail/CVE-2023-28431
advisory
-
github.com
/polkadot-evm/frontier
package
Sources
- CVE List CVE-2023-28431
- GitHub Advisory GHSA-fcmm-54jp-7vf6
- NVD CVE-2023-28431
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.