At least until its version 1.157.4-1, live-initramfs has a bug that makes it use any cleartext swap partition found on local hard disks.

Impact

Any kind of information about the user's activities can be stored on the local hard disks of the computers being used with affected amnesia systems.

Mitigation of passed effects

It is recommended to securely erase, using a program such as shred, any cleartext Linux swap partition present on computers having been used with affected amnesia systems.

Solution

We fixed this hole on 20091006 (commit 00c1ff633e8958d0233) by installing a custom fixed live-initramfs package into built images.

The relevant patch was then integrated in upstream's Git.

Affected versions

Releases 0.2-20090815 and 0.2-20090816 are affected, as well as any custom image built from Git before commit 00c1ff633e8958d0233.