Thursday, August 22nd 2024
Dual-Boot Linux Users Need to Update Systems Due to GRUB/SBAT Policy Changes in Windows
Multiple users have recently reported that the August 13 Windows 11 update causes issues with dual-boot Linux/Windows configurations. However, the issues are actually related to changes in UEFI Secure Boot Advanced Targeting (SBAT) policies. The issue stems from Microsoft enforcing SBAT and revoking old, exploitable certificates. Many Linux distributions use self-signed UEFI shims, which are no longer allowed due to known exploits. The new update revokes the SBAT certificates on affected, known exploitable versions of GRUB shipped with some Linux distributions. This can result in error messages like "Verifying shim SBAT data failed: Security Policy Violation" or "Something has gone seriously wrong: SBAT self-check failed: Security Policy Violation." To resolve this issue, Linux users need to update GRUB or disable the SBAT policy on the Linux side.
It's important to note that this is not primarily a Microsoft problem, but rather a necessary security update that affects some Linux distributions using outdated or vulnerable bootloaders. For more information on SBAT revocations and the boot process, users can refer to the Ubuntu Discourse here. This problem particularly impacts software developers and gaming enthusiasts who rely on dual-boot setups. As always, it's good practice for users to back up their data before performing any system updates. Considering alternatives like using virtual machines is also a good choice for users relying on older Linux distributions.
Source:
via Hardwareluxx.de
It's important to note that this is not primarily a Microsoft problem, but rather a necessary security update that affects some Linux distributions using outdated or vulnerable bootloaders. For more information on SBAT revocations and the boot process, users can refer to the Ubuntu Discourse here. This problem particularly impacts software developers and gaming enthusiasts who rely on dual-boot setups. As always, it's good practice for users to back up their data before performing any system updates. Considering alternatives like using virtual machines is also a good choice for users relying on older Linux distributions.
53 Comments on Dual-Boot Linux Users Need to Update Systems Due to GRUB/SBAT Policy Changes in Windows
I guess I will wait for a fix before getting the last few documents I haven't yet transferred... :-/
We pay MS and they give us crap, cull our data, and shove ads into their (paid-for) product.
the issue is that microsoft started enforcing SBAT and have revoked some old exploitable certificates
many distros use a self signed uefi shim which is no longer allowed due to exploits the new update revokes the SBAT cert on affected known exploitable versions of grub shipped with some distros.
discourse.ubuntu.com/t/sbat-revocations-boot-process/34996
updating grub or disabling the SBAT policy on the linux side will resolve the issue
tl:dr linux users need to update there systems before crying about microsoft
Linux users complain about their old, vulnerable bootloaders being disabled.
When you are unable to know how the boot process is of your box, you are doing something wrong. Or you are just lazy to learn and read.
I came to the conclusion that I do not need a bootloader anymore with an efistub kernel with an UEFI based mainboard. wiki.gentoo.org/wiki/EFI_stub
ASUS X670-P Prime and MSI B550 Gaming EDGE WIFI have an error in the UEFI. When I did not set my efi stub kernel as first place, as default, it will be forgotten very often.
There are different ways to write uefi boot entires. I use: wiki.gentoo.org/wiki/Efibootmgr--
Make backups. test restore the backups to see if your backup strategy works.
--Assuming you know your bootprocess. this was always possible since linux kernel version 2.0.0. I do not know before that point.
--
I think the hole issues is about Secure boot Option and outdated certificate. The author may look into in more detail and update the news post please.
Thanks for the update (and thanks to all that pointed the root cause out)
Windows 11 Pro annoys me very often with messages like "USe a microsoft online account" and other nonsense. That code exists. Just reuse it with a changed text.
Microsoft coders are most likely stupid. Destroying data. Someone who destroys data is stupid. Fact. Someone who writes code which destroys data is stupid. There used to be install dialogs with text. And warning text, do not click here, else ... may render your box not bootable and such.
I dislike "Linux" .... etc. in the article. That is wrong. It should be named. Ubuntu has an issue with outdated bootloader with activated Secure boot option. Assuming that this is the fact here. All those text and ubuntu page is not really clear, what the issue is. This also shows that ubuntu responsible text writers do not know where and what the issue is.
My Gentoo Linux is not affected. I also use a linux kernel in the efi-stub kernel variant. With another userspace and another toolchain. Assuming the date of the article is correct, my box was not "ruined" by the last windows 11 pro update i did a few days ago. Than I activated the 5 weeks no update option.
People forget. It is not a linux issue. It is a bootloader issue. And that is an userspace issue. And that is not linux related. Because it is not the linux kernel itself.
In comparison, when we talk about windows, we usually mean the hole package, windows kernel, hole operating system with the "userspace" and provided software and bootloader
Feel free to go to kernel.org and download. Read the gentoo handbook or the arch linux install guide. Read and understand the boot process please. Read lilo, grub 1 or grub 2 docs to understand what a bootloader does.
In any way, it's a good practice to first warn users about an update potentially making many systems unusable, at least for a while. But, Microsoft being a company run by monkeys mindlessly chanting "AI", is obviously not privy to revolutionary ideas like "good practices". A week's notice would not compromise security much further but would save some headache.