Fedora 45 OCaml 5.5.1 Mass Rebuild: Defending Against Unauthenticated Code Execution in why3, Rocq 9.3.0, and the OCaml Ecosystem

Fedora has pushed a coordinated security update for Fedora 45 that is easy to dismiss as routine maintenance — and that would be a mistake. The advisory covers a full mass rebuild of the OCaml ecosystem against OCaml 5.5.1, which addresses two security bugs in the language runtime and toolchain, alongside an update of Rocq (formerly Coq) to version 9.3.0, which resolves several CVEs. The headline issue is a critical unauthenticated code execution condition affecting the why3 verification platform and its dependency chain. The full advisory is published at LinuxSecurity, with upstream details in the OCaml 5.5.1 release notes.

If your organization runs Fedora 45 systems that build, host, or execute OCaml-based software — CI/CD build runners, formal verification pipelines, academic or research compute, or any application compiled against the OCaml runtime — this update is in your critical path. Unauthenticated remote code execution in a language runtime or verification toolchain is exactly the class of flaw that turns a build server into an initial access broker's beachhead.

Why This Advisory Matters More Than It Looks

Mass rebuild advisories tend to get deprioritized because they look like housekeeping. I've seen this pattern burn clients before: a language-runtime security fix buried in an ecosystem rebuild gets skipped because "we don't run OCaml apps." Then the post-incident forensics reveal a compromised CI runner that had the OCaml toolchain installed as a transitive dependency of something else entirely.

Three factors elevate this advisory:

Unauthenticated code execution. No credentials, no user interaction — a network-reachable or input-reachable path into code execution. That is the highest-priority exploitation class for both opportunistic attackers and APT initial access teams.
Toolchain blast radius. OCaml, why3 (a platform for deductive program verification), and Rocq (the interactive theorem prover formerly known as Coq) sit squarely in build and verification pipelines. Compromise of a compiler, runtime, or prover is a supply-chain event — anything built or verified on that host inherits the compromise.
Stacked fixes. This is not one bug. OCaml 5.5.1 fixes two security bugs; Rocq 9.3.0 fixes several CVEs. The advisory deliberately bundles them because the rebuild touches the entire ecosystem.

Technical Analysis

Affected Products and Platforms

Platform: Fedora 45 (all architectures shipping the OCaml package set)
OCaml runtime and toolchain: rebuilt against OCaml 5.5.1, which fixes two security bugs — see the upstream release notes at github.com/ocaml/ocaml/releases/tag/5.5.1
why3: the deductive verification platform, updated as part of the rebuild; the package carries the unauthenticated code execution fix referenced in the advisory title
Rocq (formerly Coq): updated to 9.3.0, fixing several CVEs in the theorem prover
Downstream: every OCaml-compiled binary and library in the Fedora 45 repos was rebuilt; systems with OCaml software installed from source or third-party repos may need manual rebuilds

Note that the advisory does not enumerate individual CVE identifiers in its summary text — the Rocq CVEs are documented in the upstream Rocq 9.3.0 release materials, and the OCaml security bugs are documented in the 5.5.1 release notes. Pull those upstream documents during your triage; do not rely on the distro advisory alone for impact assessment.

How the Vulnerability Class Works — Defender's View

Unauthenticated code execution in a verification/compiler toolchain typically materializes through one of three paths, and your detection strategy should account for all of them:

Network-reachable service path. why3 and Rocq are frequently deployed with IDE protocol servers, web-based proof interfaces, or CI integrations that accept untrusted input (proof scripts, source files) from the network. A parser or deserialization flaw in that path yields code execution as the service user — no authentication required.
Build-time input path. OCaml's toolchain processes untrusted source, interface files (.mli), and compiled artifacts (.cmi/.cmo/.cmxs). Runtime or compiler bugs reachable via crafted inputs mean that simply building attacker-controlled code — the entire business model of a CI runner — is an exploitation vector.
Plugin/FFI path. Both Rocq and the OCaml ecosystem support dynamically loaded plugins and foreign-function bindings. A flaw here lets attacker-supplied proof libraries or packages escape the intended trust boundary.

The common denominator from a detection standpoint: exploitation manifests as the toolchain process (ocamlrun, ocaml, why3, rocq, coqc-legacy binaries, or the IDE protocol server) doing things a compiler should never do — spawning shells, making outbound network connections, writing executables to unexpected paths, or loading unsigned native libraries.

Exploitation Status

As of this writing, there is no public confirmation of in-the-wild exploitation or CISA KEV listing tied to this Fedora 45 advisory. However, the "unauthenticated code execution" classification, combined with full technical details in the public upstream release notes, means proof-of-concept development is a matter of when, not if. Compiler and runtime CVEs historically get weaponized quickly once details ship, because build infrastructure is a high-value, often under-monitored target. Treat this as pre-exploitation window patching.

Detection & Response

The highest-fidelity detection strategy here is behavioral: OCaml/Rocq/why3 processes exhibiting post-exploitation behavior. These rules are tuned for build servers and developer workstations where the toolchain legitimately exists — if your environment has no OCaml footprint, any execution of these binaries at all is a finding worth investigating.

YAML

---
title: OCaml or Rocq Toolchain Spawning Shell or System Utility
id: 9f2c4a71-3b8d-4e5a-b1c6-7d8e9f0a1b2c
status: experimental
description: Detects OCaml runtime, why3, or Rocq/Coq processes spawning shells or system utilities, consistent with post-exploitation of a toolchain code execution flaw.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-45-why3-2026-403bcf6fd8
  - https://github.com/ocaml/ocaml/releases/tag/5.5.1
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/ocaml'
      - '/ocamlrun'
      - '/why3'
      - '/rocq'
      - '/coqc'
      - '/coqtop'
      - '/rocqide'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
      - '/base64'
  condition: selection_parent and selection_child
falsepositives:
  - Build scripts legitimately invoking subshells via dune or ocamlfind build rules
  - why3 IDE integrations spawning external provers
level: high
---
title: Outbound Network Connection from OCaml Runtime or Proof Toolchain
id: 4b7e1d52-6c3f-4a9d-8e2b-5f6a7c8d9e0f
status: experimental
description: Detects outbound network connections initiated by OCaml runtime, why3, or Rocq binaries. Compilers and provers rarely initiate direct outbound connections; this is a strong post-exploitation signal.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-45-why3-2026-403bcf6fd8
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|endswith:
      - '/ocamlrun'
      - '/why3'
      - '/rocq'
      - '/coqc'
      - '/coqtop'
    Initiated: 'true'
  filter_opam:
    Image|endswith:
      - '/opam'
  condition: selection and not filter_opam
falsepositives:
  - opam package manager fetching packages (excluded)
  - Rocq/Coq library index lookups in some IDE configurations
level: medium

KQL — Microsoft Sentinel / Defender

// Hunt for OCaml/why3/Rocq toolchain processes spawning shells or network tools
// Works against Syslog/CEF-ingested Linux auditd data in Microsoft Sentinel
union isfuzzy=true
(Syslog
| where Facility =~ "auth" or Facility =~ "local4" or SyslogMessage has_any ("ocaml", "ocamlrun", "why3", "rocq", "coqc")
| where SyslogMessage has_any ("/bin/sh", "/bin/bash", "curl", "wget", "nc ", "ncat", "python3")
| extend ParentProcess = extract(@"(?:ocamlrun|ocaml|why3|rocq|coqc|coqtop)", 0, SyslogMessage)
| project TimeGenerated, Computer, ProcessName, SyslogMessage
),
(DeviceProcessEvents
| where InitiatingProcessFileName has_any ("ocaml", "ocamlrun", "why3", "rocq", "coqc", "coqtop")
| where FileName has_any ("sh", "bash", "dash", "curl", "wget", "nc", "ncat", "python3")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName)
| order by TimeGenerated desc

// Second query: outbound network connections from toolchain binaries (Defender for Endpoint on Linux)
DeviceNetworkEvents
| where InitiatingProcessFileName has_any ("ocamlrun", "why3", "rocq", "coqc", "coqtop")
| where InitiatingProcessFileName != "opam"
| where RemoteUrl !has_any ("fedoraproject.org", "opam.ocaml.org") or isempty(RemoteUrl)
| summarize ConnectionCount = count(), RemoteIPs = make_set(RemoteIP) by DeviceName, InitiatingProcessFileName, bin(TimeGenerated, 1h)
| order by TimeGenerated desc

VQL — Velociraptor

-- Hunt: OCaml/Rocq/why3 toolchain processes and their suspicious children
-- Deploy across Fedora 45 build runners, dev workstations, and research compute
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE (Name =~ '(?i)ocamlrun|ocaml|why3|rocq|coqc|coqtop'
   OR CommandLine =~ '(?i)ocamlrun|why3|rocq')
   AND Username != 'root'

-- Correlate: find shells or download tools whose parent is the toolchain
SELECT child.Pid AS ChildPid,
       child.Name AS ChildName,
       child.CommandLine AS ChildCmdline,
       parent.Name AS ParentName,
       parent.CommandLine AS ParentCmdline,
       child.Username AS Username,
       child.CreateTime AS CreateTime
FROM pslist() AS child
JOIN pslist() AS parent ON child.Ppid = parent.Pid
WHERE parent.Name =~ '(?i)ocamlrun|ocaml|why3|rocq|coqc|coqtop'
  AND child.Name =~ '(?i)^sh$|bash|dash|curl|wget|nc$|ncat|python'

-- Check installed package versions to confirm patch state
SELECT * FROM execve(argv=['rpm', '-qa', '--queryformat',
   '%{NAME} %{VERSION}-%{RELEASE}\n', 'ocaml*', 'why3*', 'rocq*'])

Remediation

Apply the Fedora 45 update immediately on all affected systems, then verify versions. The following script updates the ecosystem, confirms the patched versions are installed, and flags any OCaml binaries not owned by RPM (indicating source-built copies that need manual rebuilds):

Bash / Shell

#!/bin/bash
# Fedora 45 OCaml ecosystem security remediation and verification
# Advisory: https://linuxsecurity.com/advisories/fedora/fedora-45-why3-2026-403bcf6fd8

set -euo pipefail

echo "=== [1/5] Applying Fedora 45 OCaml/why3/Rocq updates ==="
dnf clean all
dnf update -y 'ocaml*' 'why3*' 'rocq*' 'coq*'
# Full refresh to catch all rebuilt reverse-dependencies
dnf update -y --refresh

echo "=== [2/5] Verifying patched versions ==="
echo "--- OCaml ---"
rpm -q ocaml ocaml-runtime 2>/dev/null || echo "ocaml not installed"
TARGET_OCAML="5.5.1"
INSTALLED_OCAML=$(rpm -q --queryformat '%{VERSION}' ocaml 2>/dev/null || echo "none")
if [ "$INSTALLED_OCAML" != "none" ]; then
  if [ "$INSTALLED_OCAML" = "$TARGET_OCAML" ]; then
    echo "OK: OCaml $INSTALLED_OCAML (patched)"
  else
    echo "WARNING: OCaml $INSTALLED_OCAML installed — expected $TARGET_OCAML"
  fi
fi

echo "--- why3 ---"
rpm -q why3 2>/dev/null || echo "why3 not installed"

echo "--- Rocq ---"
ROCQ_VER=$(rpm -q --queryformat '%{VERSION}' rocq 2>/dev/null || echo "none")
if [ "$ROCQ_VER" != "none" ]; then
  if [ "$ROCQ_VER" = "9.3.0" ]; then
    echo "OK: Rocq $ROCQ_VER (patched)"
  else
    echo "WARNING: Rocq $ROCQ_VER — expected 9.3.0"
  fi
else
  rpm -q coq 2>/dev/null && echo "WARNING: legacy 'coq' package present — migrate to rocq 9.3.0" || echo "rocq/coq not installed"
fi

echo "=== [3/5] Checking for stale or source-built OCaml binaries ==="
for bin in ocaml ocamlrun ocamlfind why3 rocq coqc coqtop; do
  BINPATH=$(command -v "$bin" 2>/dev/null || true)
  if [ -n "$BINPATH" ]; then
    if ! rpm -qf "$BINPATH" &>/dev/null; then
      echo "ALERT: $BINPATH is NOT owned by any RPM package — likely source-built. Rebuild against OCaml 5.5.1."
    fi
  fi
done

echo "=== [4/5] Identifying running processes linked against old libraries ==="
if command -v needs-restarting &>/dev/null; then
  needs-restarting -r || echo "REBOOT RECOMMENDED to load patched runtime libraries"
fi

echo "=== [5/5] Summary ==="
echo "Rebuild any locally compiled OCaml applications against the patched toolchain."
echo "Review upstream notes: https://github.com/ocaml/ocaml/releases/tag/5.5.1"

Prioritized Remediation Guidance

Patch internet-facing and CI-connected systems first. Build runners, shared verification servers, and any host accepting untrusted proof/source input are the highest-risk assets. Patch within your emergency window (24–72 hours), not your monthly cycle.
Rebuild source-built OCaml software. Anything compiled against the vulnerable runtime inherits the flaw. The script above flags non-RPM-owned binaries; rebuild each against OCaml 5.5.1.
Restart or reboot. Long-running OCaml services keep old runtime code mapped until restarted. Use needs-restarting and bounce affected services — or schedule the reboot.
Inventory your exposure. Query your CMDB/EDR for ocamlrun, why3, rocq, and legacy coq binaries across the fleet. Transitive dependencies are where these runtimes hide.
Review the upstream release notes (OCaml 5.5.1) and the Rocq 9.3.0 release materials to enumerate the specific CVEs fixed and assess applicability to your deployment topology — especially if you expose why3 or Rocq through web IDEs or CI integrations.
Network segmentation as a compensating control. Until patching is complete, restrict inbound access to any host running why3/Rocq services to trusted build networks only, and egress-filter toolchain hosts — a compiler that needs outbound internet is the exception, not the rule.

Bottom Line

Language-runtime and toolchain advisories are supply-chain advisories. An unauthenticated code execution flaw in the OCaml ecosystem — patched via the Fedora 45 rebuild to OCaml 5.5.1 and Rocq 9.3.0 — is a direct path to your build infrastructure, your signed artifacts, and everything downstream of them. Patch the distro packages, rebuild what you compiled yourself, and deploy behavioral detection on toolchain process trees. The window between public technical details and weaponized PoC for this bug class is historically short.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub