Thursday, August 22nd 2024

Dual-Boot Linux Users Need to Update Systems Due to GRUB/SBAT Policy Changes in Windows

Multiple users have recently reported that the August 13 Windows 11 update causes issues with dual-boot Linux/Windows configurations. However, the issues are actually related to changes in UEFI Secure Boot Advanced Targeting (SBAT) policies. The issue stems from Microsoft enforcing SBAT and revoking old, exploitable certificates. Many Linux distributions use self-signed UEFI shims, which are no longer allowed due to known exploits. The new update revokes the SBAT certificates on affected, known exploitable versions of GRUB shipped with some Linux distributions. This can result in error messages like "Verifying shim SBAT data failed: Security Policy Violation" or "Something has gone seriously wrong: SBAT self-check failed: Security Policy Violation." To resolve this issue, Linux users need to update GRUB or disable the SBAT policy on the Linux side.

It's important to note that this is not primarily a Microsoft problem, but rather a necessary security update that affects some Linux distributions using outdated or vulnerable bootloaders. For more information on SBAT revocations and the boot process, users can refer to the Ubuntu Discourse here. This problem particularly impacts software developers and gaming enthusiasts who rely on dual-boot setups. As always, it's good practice for users to back up their data before performing any system updates. Considering alternatives like using virtual machines is also a good choice for users relying on older Linux distributions.
Source: via Hardwareluxx.de
Add your own comment

53 Comments on Dual-Boot Linux Users Need to Update Systems Due to GRUB/SBAT Policy Changes in Windows

#51
trparky
ZareekYes please! Although, that might only add to my biggest gripe with Linux, segmentation. If everyone just came together and made one unified Linux desktop distro, it could run circles around Windows. It already does as a server OS.
I've been saying that for years now. If the Linux community really wanted to kill Microsoft stone dead, it could happen tomorrow. But no, we can't do that all because of this mystical thing called "choice." Well, the average user couldn't give rat's ass about choice. They just want to sit down at their computer and watch TikTok's and Instagrams. But until the Linux community pulls their collective heads out of their equally collective asses and realizes that they need to cater to the average user, Windows is what we have to deal with. :rolleyes:

I'd love to see Windows as nothing more than a footnote in the history books but I just don't see it happening when I look at the fragmentation of the Linux community.
Posted on Reply
#52
lexluthermiester
trparkyThey just want to sit down at their computer and watch TikTok's and Instagrams.
IG's maybe. But in my neck of the woods, more people watch Netflix, Youtube and other streaming services rather than TikTox.
Posted on Reply
#53
b1k3rdude
R-T-BNot without consent. They own they keys that you are running. That's the premise of secure boot. Linux can do the same. In the past, it even has.
But I imagine linux is more forthcoming and less surreptitious when it does..?
R-T-BWell... secure boot itself as a REQUIREMENT has always been a bit iffy with me, so yeah.
Indeed, there was an article a few years back that laid bare what Secure boot 'actually is' and in short its nothing of the sort. Would like to find and bookmark said article as Im constant pointing it out heh. I refuse to enable it or bitlocker, if I really want security I would use a self enrypting SSD or as I do atm, 3rd party file/folder encryption.
Posted on Reply
Add your own comment
Nov 21st, 2024 10:21 EST change timezone

New Forum Posts

Popular Reviews

Controversial News Posts