From owner-freebsd-security@FreeBSD.ORG  Tue Nov  6 18:47:06 2012
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
 by hub.freebsd.org (Postfix) with ESMTP id 3D26E125
 for <freebsd-security@freebsd.org>; Tue,  6 Nov 2012 18:47:06 +0000 (UTC)
 (envelope-from freebsd@psconsult.nl)
Received: from mx1.psconsult.nl (unknown [IPv6:2001:7b8:30f:e0::5059:ee8a])
 by mx1.freebsd.org (Postfix) with ESMTP id DF8B68FC0A
 for <freebsd-security@freebsd.org>; Tue,  6 Nov 2012 18:47:05 +0000 (UTC)
Received: from mx1.psconsult.nl (mx1.hvnu.psconsult.nl [46.44.189.154])
 by mx1.psconsult.nl (8.14.5/8.14.4) with ESMTP id qA6Ikw4p024494
 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
 for <freebsd-security@freebsd.org>; Tue, 6 Nov 2012 19:47:03 +0100 (CET)
 (envelope-from freebsd@psconsult.nl)
Received: (from paul@localhost)
 by mx1.psconsult.nl (8.14.5/8.14.4/Submit) id qA6Ikw3Z024493
 for freebsd-security@freebsd.org; Tue, 6 Nov 2012 19:46:58 +0100 (CET)
 (envelope-from freebsd@psconsult.nl)
X-Authentication-Warning: mx1.psconsult.nl: paul set sender to
 freebsd@psconsult.nl using -f
Date: Tue, 6 Nov 2012 19:46:58 +0100
From: Paul Schenkeveld <freebsd@psconsult.nl>
To: freebsd-security@freebsd.org
Subject: md(4) (swap-base) disks not cleaned on creation
Message-ID: <20121106184658.GA24262@psconsult.nl>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
User-Agent: Mutt/1.5.21 (2010-09-15)
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: "Security issues \[members-only posting\]"
 <freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-security>, 
 <mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
 <mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 06 Nov 2012 18:47:06 -0000

Hi,

When creating a swap based md(4) it may contain data which to me feels
like a security leak:

  # mdconfig -a -t swap -s 1m
  md0
  # hd /dev/md0
  00000000  c0 9b a8 00 08 00 00 00  00 5c 53 00 08 00 00 00  |À.¨......\S.....|
  00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
  *
  00000250  38 9f a8 00 08 00 00 00  00 5c 53 00 08 00 00 00  |8.¨......\S.....|
  00000260  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
  *
  00000330  88 a0 a8 00 08 00 00 00  00 5c 53 00 08 00 00 00  |. ¨......\S.....|
  00000340  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
  *
  00000370  e8 a0 a8 00 08 00 00 00  00 5c 53 00 08 00 00 00  |è ¨......\S.....|
  00000380  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
  *
  000005b0  48 a4 a8 00 08 00 00 00  00 5c 53 00 08 00 00 00  |H¤¨......\S.....|
  000005c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
  *
  ^C
  # ls -l /dev/md0
  crw-r-----  1 root  operator  0xc8 Nov  6 19:42 /dev/md0
  #

Although not world-readable, it just doesn't feel right to me.

Any thoughts?

With kind regards,

Paul Schenkeveld