08-21-2024, 04:10 PM
This post was last modified 08-21-2024, 04:24 PM by Maxmars.
Edit Reason: added content
Just a heads up in case anyone has run into this message...
From ARS Technica: “Something has gone seriously wrong,” dual-boot systems warn after Microsoft update
Subtitled: Microsoft said its update wouldn't install on Linux devices. It did anyway.
Last Tuesday, loads of Linux users—many running packages released as early as this year—started reporting their devices were failing to boot. Instead, they received a cryptic error message that included the phrase: “Something has gone seriously wrong.”
The cause: an update Microsoft issued as part of its monthly patch release. It was intended to close a 2-year-old vulnerability in GRUB, an open source boot loader used to start up many Linux devices. The vulnerability, with a severity rating of 8.6 out of 10, made it possible for hackers to bypass secure boot, the industry standard for ensuring that devices running Windows or other operating systems don’t load malicious firmware or software during the bootup process. CVE-2022-2601 was discovered in 2022, but for unclear reasons, Microsoft patched it only last Tuesday.
...
Tuesday’s update left dual-boot devices—meaning those configured to run both Windows and Linux—no longer able to boot into the latter when Secure Boot was enforced. When users tried to load Linux, they received the message: “Verifying shim SBAT data failed: Security Policy Violation. Something has gone seriously wrong: SBAT self-check failed: Security Policy Violation.” Almost immediately support and discussion forums lit up with reports of the failure.
“Note that Windows says this update won't apply to systems that dual-boot Windows and Linux,” one frustrated person wrote. “This obviously isn't true, and likely depends on your system configuration and the distribution being run. It appears to have made some linux efi shim bootloaders incompatible with microcrap efi bootloaders (that's why shifting from MS efi to 'other OS' in efi setup works). It appears that Mint has a shim version that MS SBAT doesn't recognize.”
The reports indicate that multiple distributions, including Debian, Ubuntu, Linux Mint, Zorin OS, and Puppy Linux, are all affected. Microsoft has yet to acknowledge the error publicly, explain how it wasn’t detected during testing, or provide technical guidance to those affected. Company representatives didn’t respond to an email seeking answers.
Since several members here are tinkering with Linux, I felt it might be a good idea to share this....
[Edit to add]
From ZDNet: Windows update breaks Linux dual boot - but there is a fix for some users
Although Microsoft has yet to comment on the issue, there is a workaround for Ubuntu users. Here are the steps to solve the problem.
- Disable Secure Boot in the BIOS (how this is done will depend on your PC make and model).
- Log into a user account with sudo privileges.
- Ensure that Secure Boot is disabled with the command mokutil --sb (the output of the command should be SecureBoot disabled. If you don't see that message, reboot, access the BIOS, and make sure Secure Boot is disabled).
- To manually delete Microsoft's SBAT Policy, open a terminal window and issue the command sudo mokutil --set-sbat-policy delete. Reboot the machine and log back in with the same user to update the SBAT policy.
- Once you've done this, reboot the machine, access the BIOS, and re-enable Secure Boot.
This isn't the only issue to affect Secure Boot lately. The last year and a half has seen four vulnerabilities capable of neutralizing Secure Boot such that malicious code could be injected during the boot process.
I hope this helps...
From ARS Technica: “Something has gone seriously wrong,” dual-boot systems warn after Microsoft update
Subtitled: Microsoft said its update wouldn't install on Linux devices. It did anyway.
Last Tuesday, loads of Linux users—many running packages released as early as this year—started reporting their devices were failing to boot. Instead, they received a cryptic error message that included the phrase: “Something has gone seriously wrong.”
The cause: an update Microsoft issued as part of its monthly patch release. It was intended to close a 2-year-old vulnerability in GRUB, an open source boot loader used to start up many Linux devices. The vulnerability, with a severity rating of 8.6 out of 10, made it possible for hackers to bypass secure boot, the industry standard for ensuring that devices running Windows or other operating systems don’t load malicious firmware or software during the bootup process. CVE-2022-2601 was discovered in 2022, but for unclear reasons, Microsoft patched it only last Tuesday.
...
Tuesday’s update left dual-boot devices—meaning those configured to run both Windows and Linux—no longer able to boot into the latter when Secure Boot was enforced. When users tried to load Linux, they received the message: “Verifying shim SBAT data failed: Security Policy Violation. Something has gone seriously wrong: SBAT self-check failed: Security Policy Violation.” Almost immediately support and discussion forums lit up with reports of the failure.
“Note that Windows says this update won't apply to systems that dual-boot Windows and Linux,” one frustrated person wrote. “This obviously isn't true, and likely depends on your system configuration and the distribution being run. It appears to have made some linux efi shim bootloaders incompatible with microcrap efi bootloaders (that's why shifting from MS efi to 'other OS' in efi setup works). It appears that Mint has a shim version that MS SBAT doesn't recognize.”
The reports indicate that multiple distributions, including Debian, Ubuntu, Linux Mint, Zorin OS, and Puppy Linux, are all affected. Microsoft has yet to acknowledge the error publicly, explain how it wasn’t detected during testing, or provide technical guidance to those affected. Company representatives didn’t respond to an email seeking answers.
Since several members here are tinkering with Linux, I felt it might be a good idea to share this....
[Edit to add]
From ZDNet: Windows update breaks Linux dual boot - but there is a fix for some users
Although Microsoft has yet to comment on the issue, there is a workaround for Ubuntu users. Here are the steps to solve the problem.
- Disable Secure Boot in the BIOS (how this is done will depend on your PC make and model).
- Log into a user account with sudo privileges.
- Ensure that Secure Boot is disabled with the command mokutil --sb (the output of the command should be SecureBoot disabled. If you don't see that message, reboot, access the BIOS, and make sure Secure Boot is disabled).
- To manually delete Microsoft's SBAT Policy, open a terminal window and issue the command sudo mokutil --set-sbat-policy delete. Reboot the machine and log back in with the same user to update the SBAT policy.
- Once you've done this, reboot the machine, access the BIOS, and re-enable Secure Boot.
This isn't the only issue to affect Secure Boot lately. The last year and a half has seen four vulnerabilities capable of neutralizing Secure Boot such that malicious code could be injected during the boot process.
I hope this helps...
