How Git could be attacked if SHA-1 gets broken
kitenet.net
kitenet.net
No-one will accept a patch that introduces some garbled stuff into their repository, as it's just nonsense.
Even if you are able to upload it as a 'firmware patch' which goes by unchecked by everyone else, you still won't be able to produce any form of firmware that'll actually do something you want it to do -- let alone two versions that can run on the same hardware, where one is exploitless and the other has an exploit.
For that kind of stuff you'll have to wait a long time. It's still not even possible with MD5 (though partial data can be preserved with some of the attacks).
Basically, you generate two colliding blobs of random data, and then append identical code to each of them. The resulting concatenations also collide. The code is designed to behave differently depending on which blob precedes it.
That alone isn't very useful. It would be obvious to anyone who reviewed the code that something is going on, and the whole point of the attack is to fool code reviewers. But if you're clever you could obfuscate this in a number of ways. For example, if you can generate a large number of collisions, you could find a pair of blobs such that a given substring, when interpreted as data or code, produces correct behavior for one version and insecure behavior for the other.
This is similar to that exploit on MD5 signatures of PDFs: trick someone into blessing something with harmless effects, and then change part of it so that the effects become harmful. It's not the most dangerous thing in the world, as we have human gatekeepers to ward against this sort of attack, but it may be something to watch out for.