CVE-2023-28431: falha de alta gravidade em paritytech frontier
Frontier's modexp precompile is slow for even modulus
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 0.9%
Frontier is an Ethereum compatibility layer for Substrate. Frontier's `modexp` precompile uses `num-bigint` crate under the hood. In the implementation prior to pull request 1017, the cases for modulus being even and modulus being odd are treated separately. Odd modulus uses the fast Montgomery multiplication, and even modulus uses the slow plain power algorithm. This gas cost discrepancy was not accounted for in the `modexp` precompile, leading to possible denial of service attacks.
No fixes for `num-bigint` are currently available, and thus this issue is fixed in the short term by raising the gas costs for even modulus, and in the long term fixing it in `num-bigint` or switching to another modexp implementation. The short-term fix for Frontier is deployed at pull request 1017. There are no known workarounds aside from applying the fix.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
paritytech · frontierCVEs relacionadas — paritytech frontier
No mesmo produto, das mais perigosas para as menos.
CVE-2022-31111MEDIUMDiscrepency in transfer value and actual value due to incorrect truncation in FrontierEPSS 1.4%CVE-2021-41138MEDIUMValidity check for signed Frontier-specific extrinsic not called in block executionEPSS 1.4%CVE-2022-21685MEDIUMInteger underflow in FrontierEPSS 1.4%CVE-2022-36008HIGHMessage length overflow in frontierEPSS 1.3%CVE-2021-39193MEDIUMTransaction validity oversight in pallet-ethereumEPSS 1.2%CVE-2023-45130HIGHFrontier opcode SUICIDE touches too many storage values on large contractsEPSS 1.0%
Referências
https://github.com/paritytech/frontier/commit/5af12e94d7dfc8a0208a290643a800f55de7b219https://github.com/paritytech/frontier/pull/1017https://github.com/paritytech/frontier/security/advisories/GHSA-fcmm-54jp-7vf6https://github.com/rust-num/num-bigint/blob/6f2b8e0fc218dbd0f49bebb8db2d1a771fe6bafa/src/biguint/power.rs#L134