Linux bk2cvs mirror received backdoor

In November 2003, the Linux kernel was maintained in BitKeeper, with a separate CVS mirror available for developers who could not or would not use BitKeeper directly. An attacker modified the CVS-side kernel/exit.c history instead of landing a real BitKeeper changeset; Larry McVoy could only narrow the entry point to someone who had touched the file "either on kernel.bkbits.net or managed to get in through the pserver." That distinction mattered: the poisoned revisions appeared in the mirror, but not in the authoritative development tree used for mainline integration.

The change was small enough to be read and large enough to matter. It lived in kernel/exit.c, in the wait path, and looked like an error check. The three forged revisions were stamped 2003/11/04 between 16:22 and 16:44 and logged under author: davem, borrowing the name of kernel maintainer David S. Miller, who denied making them. The planted CVS revisions lacked normal BitKeeper logical-change backlinks, which made the source-control metadata as important as the C code.

The inserted code checked for options == (__WCLONE|__WALL) and then evaluated current->uid = 0, turning what looked like a comparison into an assignment that would make the caller root. BitMover's conversion checks caught the fraud quickly because normal CVS mirror entries carried logical-change backlinks to BitKeeper changesets, while the planted revisions did not. The incident became an early, concrete example of why source-control provenance matters as much as code review.

The attack failed because the mirror was not the source of truth. That is the important distinction for this record: the code change was malicious, but the project workflow still had an authoritative history that let maintainers separate a forged mirror revision from a real kernel change.