CVE-2020-37268: Coq Proof Assistant Privilege Escalation

CVE-2020-37268 Overview

CVE-2020-37268 affects the Rocq (formerly Coq) proof assistant. The Print Assumptions command fails to report that a definition was produced while universe checking was disabled when that definition reaches the caller through Parameter Inline in a module type. Applying a functor inlines the parameter body and drops the record that the term was built under Unset Universe Checking. A module implementation can prove False using a universe inconsistency, expose it through an inlined parameter, and have Print Assumptions report the dependent proof as closed under the global context. The standalone checker coqchk still rejects the resulting compiled file.

Critical Impact
A malicious or buggy Rocq/Coq development can prove arbitrary propositions while passing the in-process Print Assumptions audit that consumers rely on to verify trustworthiness.

Affected Products

Rocq prover (formerly Coq)
Developments consuming modules with Parameter Inline declarations
Toolchains that rely solely on Print Assumptions without running coqchk

Discovery Timeline

2026-08-24 - CVE-2020-37268 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2020-37268

Vulnerability Analysis

The issue is classified as insufficient logging [CWE-778]. Print Assumptions is the in-process audit Rocq users invoke to confirm that a proof depends on no unexpected axioms or unsafe operations. When a module author disables universe checking with Unset Universe Checking, definitions built under that mode are normally flagged so downstream consumers can see the unsafe origin.

The bug lies in how the kernel handles functor application involving Parameter Inline. Inlining substitutes the parameter body directly into the resulting constant. During that substitution, the flag recording that the term was built under disabled universe checking is not propagated. The resulting constant therefore appears to Print Assumptions as an ordinary, closed term.

Because universe consistency is what prevents Prop and Type from collapsing, disabling it enables proofs of False. A downstream development can import the inlined constant, derive any proposition from False, and still have Print Assumptions report the proof as closed under the global context.

Root Cause

The root cause is missing metadata propagation during functor inlining in the Rocq kernel. The record indicating a term was produced with Unset Universe Checking is stored on the original constant but is lost when the parameter body is inlined into a new constant through Parameter Inline. The project tracks this in dev/doc/critical-bugs.md under non-fixed bugs and rates the residual risk as moderate when coqchk is not run.

Attack Vector

An attacker publishes a Rocq library or module that internally disables universe checking, proves False, and exposes the resulting term through a module type using Parameter Inline. A consumer applies the functor, imports the resulting constant, and uses it to prove arbitrary theorems. The consumer runs Print Assumptions as part of their trust review and sees no unsafe assumptions reported. Exploitation requires the victim to import and trust the malicious development, so the attack vector is local and user-interaction dependent. The standalone coqchk checker rejects the compiled file, so a full external verification step still detects the inconsistency.

Refer to the GitHub PoC Repository and GitHub Issue #12155 for a reproducer that constructs the unsafe module and demonstrates the audit bypass.

Detection Methods for CVE-2020-37268

Indicators of Compromise

Rocq/Coq source files that use Unset Universe Checking in combination with module types containing Parameter Inline declarations.
Compiled .vo files that Print Assumptions reports as closed but that coqchk rejects with a universe inconsistency.
Third-party Rocq packages introducing functors whose parameters are inlined and whose bodies transitively depend on universe-unchecked constants.

Detection Strategies

Run coqchk on every compiled artifact in the dependency graph and treat rejections as build failures. This is the only in-tree method that reliably catches the inconsistency.
Statically scan project sources for co-occurrence of Unset Universe Checking and Parameter Inline and flag combinations for manual review.
Diff Print Assumptions output against coqchk results in continuous integration to surface discrepancies between the two audits.

Monitoring Recommendations

Track upstream advisories from the Rocq project and the critical bugs list for status changes.
Monitor build logs for use of Unset Universe Checking in third-party dependencies pulled via package managers such as opam.
Review the VulnCheck advisory for updates and any published fixes.

How to Mitigate CVE-2020-37268

Immediate Actions Required

Add coqchk to the release and CI pipeline for every Rocq/Coq development and fail the build on any rejection.
Audit direct and transitive dependencies for use of Unset Universe Checking combined with inlined module parameters.
Stop relying on Print Assumptions as the sole trust anchor for proof developments.

Patch Information

At the time of NVD publication (2026-08-24), the Rocq project records CVE-2020-37268 in dev/doc/critical-bugs.md under non-fixed bugs. No upstream patch is referenced in the enriched data. Track the GitHub Issue #12155 and the critical bugs documentation for fix status.

Workarounds

Always run coqchk on compiled .vo files before shipping or trusting a development.
Refactor module types to avoid Parameter Inline when the underlying implementation uses Unset Universe Checking.
Prohibit Unset Universe Checking in project coding standards except in isolated, reviewed modules that are never exposed through inlined parameters.

bash

# Run the standalone checker against every compiled Rocq artifact
find . -name '*.vo' -print0 | xargs -0 -n1 coqchk -silent -o

# Fail CI if any source combines Unset Universe Checking with Parameter Inline
grep -RIn --include='*.v' -e 'Unset Universe Checking' -e 'Parameter Inline' . \
  && echo 'Review required: potential CVE-2020-37268 exposure' && exit 1