3 ms·
They gained root access. So some one could do sudo su - linus cd /path/to/linux-2.6.git modify/exploit code and git commit I for example do a daily git pull
by blinkingled 15y ago
They gained root access. So some one could do
sudo su - linus
cd /path/to/linux-2.6.git
modify/exploit code and git commit
I for example do a daily git pull - I will get the the tainted code and not notice it at all.
NO?
- ajross 15y agoBut that's just HEAD. No offense, but so what? Clearly anyone (sane) running off of a development branch isn't doing so on a security sensitive system. It's an exploit, but only of development systems and a tiny handful of hacker's personal boxes. The value there to an attacker is very low. What you can't do is inject code that ends up in 3.1-rc5, because before that gets tagged Linus (and a lot of other people) would have to do a merge that would fail inexplicably. But to be clear: yes, with access to the repository you can (for a brief moment until it's noticed) inject exploit code that will be picked up by anyone building and running an untagged branch HEAD.
- blinkingled 15y agoUbuntu does daily kernel builds and many people run that kernel - to see if some bug has been fixed, to get support for their newer hardware etc. Lots of reasons perfectly sane people can end up testing a daily build.
- rpearl 15y agoThe code would not be signed by Linus; you do not know his private key. If I as a developer then pull and verify signatures, I would note that commit was unsigned and expect the commit to be compromised.
- danieldk 15y agoBut you cannot sign commits in git, only tags, right?