{"id":125748,"date":"2025-06-01T15:05:12","date_gmt":"2025-06-01T13:05:12","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/inczident-s-podmenoj-kommitov-v-vetke-yadra-linux-ot-kesa-kuka"},"modified":"2025-06-01T15:05:12","modified_gmt":"2025-06-01T13:05:12","slug":"inczident-s-podmenoj-kommitov-v-vetke-yadra-linux-ot-kesa-kuka","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/inczident-s-podmenoj-kommitov-v-vetke-yadra-linux-ot-kesa-kuka","title":{"rendered":"Incident of commit hijacking in the Linux kernel branch by Kesa Cook","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Linus Torvalds demanded that the administrator of kernel.org immediately block the account of Kesa Cook, the former chief sysadmin of kernel.org and leader of the Ubuntu Security Team, overseeing 14 security-related subsystems in the kernel. Konstantin Ryabcev, responsible for kernel.org's infrastructure, executed the block. The reason for the block was a pull request to include changes in the 6.16 kernel branch, referencing a git repository where the authorship information for some commits was altered. <\/p>\n
In the Git repository supported by Kess, there were fictitious changes where the author and committer fields were listed as \"Linus Torvalds,\" but Linus did not add them. For example, under Linus's name in Kess's branch, there was a commit that duplicated another commit in Linus's branch, but with a different SHA1 hash. Both commits appear identical, except for the signature information. <\/p>\n
The changes did not resemble a random error during the \"git rebase\" operation, as they contained incorrect information about the commit's author. Linus Torvalds considered this evidence of potentially malicious activity and initiated a block on accepting any changes from Kess until the reasons for such manipulations were clarified and it was confirmed that Kess's system was not compromised. <\/p>\n
Kess responded that he did not understand how this could have happened. Previously, he had encountered issues when attempting to merge several of his Git branches, after which he tried to resolve them with the \"git rebase\" operation, but it seemed that did not help. All this occurred against the backdrop of an SSD drive failure that was generating errors during copying. Kess believed he had managed to restore the state of his repositories after the failure, but apparently, that was not the case. To restore integrity, Kess intends to recreate his branches from separate patches. He considers a failed attempt to recover the repository after its corruption as the most likely cause of the author substitution. <\/p>\n
Linus was not satisfied with this explanation, as in his opinion, the changes in the commit history of Kess's repository looked very much like deliberate actions rather than a random failure. Rebasing the history of changes with the \"git rebase\" operation could explain the overwriting of the committer, but Linus cannot understand how such a \"git rebase\" operation could have been performed by mistake. <\/p>\n
Rewriting one or two commits could still be attributed to an error, but in Kess's repository, over six thousand merge commits were rewritten, of which Linus was listed as the author in 330, even though those commits were not obtained from Linus's git tree. The changes performed are more reminiscent of a script's actions than a result of data corruption on the storage, as they require a separate recreation of each commit copy. <\/p>\n
Kes assured Linus that he did not do this intentionally and would not conduct such experiments without prior warning (for instance, the previous experiment to trigger commit collisions was agreed upon with Linus). This week, he performed several manual operations on the repository and is now trying to figure out what went wrong and reproduce the issue. For example, Kes executed a rebase operation for the git branches for-next\/hardening and for-linus\/hardening, using the 'master' branch instead of rc2, unlike previous transformations. During this operation, he made changes to the scripts for checking pull requests. <\/p>\n