live-initramfs boot scripts, that are used in amnesia, can boot an untrusted Live system found on the local hard-disk, rather than the one present on the USB stick on CD, as could be expected.

This can only happen in the (pretty rare) case when Linux needs more than 15 seconds to make the legitimate USB stick or CD ready.

Impact

Booting another Live system than the one you think, without being told, can lead to any kind of information leak, anonymity break, etc.

Solution

None yet. Either build your own images from Git, or wait for the imminent 0.4.2 release.

Mitigation

Do not use amnesia on untrusted computers.

Affected versions

Any Debian Live-based system, including every amnesia release until, and including, 0.4.1.