26

My Ubuntu (20.04) Software is prompting a new firmware available: UEFI dbx 77--> 217 (?), but when I try to update I receive the following error message:

Impossible to update UEFI dbx.
Blocked executable in the ESP, ensure grub and shim are up to date:/boot/efi/EFI/Boot/shimx64.efi Authenticode checksum [_checksum code_] is presente in dbx.

I am not really sure what this implies and, if I understood it correctly, why is it jumping from version 77 to 217. A bit more of details on the system:

$ lscpu
Architecture:                    x86_64
CPU op-mode(s):                  32-bit, 64-bit
Byte Order:                      Little Endian
Address sizes:                   39 bits physical, 48 bits virtual
CPU(s):                          12
On-line CPU(s) list:             0-11
Thread(s) per core:              2
Core(s) per socket:              6
Socket(s):                       1
NUMA node(s):                    1
Vendor ID:                       GenuineIntel
CPU family:                      6
Model:                           165
Model name:                      Intel(R) Core(TM) i7-10850H CPU @ 2.70GHz
4
  • 1
    A version of Ubuntu in the question is always helpful. Also how does the CPU info fit in with the question?
    – David
    Commented Sep 16, 2022 at 13:39
  • Edited to add Ubuntu version
    – Py-ser
    Commented Sep 16, 2022 at 13:55
  • 3
    Other answers are likely correct, but one minor point: The dbx is a UEFI Secure Boot variable that holds information to identify untrusted boot loaders. It doesn't really have a version number per se. Chances are the "77 --> 217" note was saying that it was being expanded from 77 entries to 217 entries. A computer I bought in 2020 came with 77 dbx entries, and the number has gone up significantly since then. I don't know if 217 is the current number, but it's plausible. (Microsoft maintains a more-or-less standard set of dbx entries.)
    – Rod Smith
    Commented Mar 5, 2023 at 4:24
  • 1
    See also data in the UEFI Revocation List File by the Unified Extensible Firmware Interface Forum.
    – Joel Purra
    Commented Dec 29, 2023 at 11:18

6 Answers 6

19

I had a similar problem on my Dell 5820 under Ubuntu 22.04. I suggest checking whether the binary is used.

To do this I suggest to check whether the file /boot/efi/EFI/Boot/shimx64.efi is listed in the boot entries:

efibootmgr -v

In my case it was not but the more recent (note the slight difference in path) /boot/efi/EFI/ubuntu/shimx64.efi was used.

I then noticed that /boot/efi/EFI/Boot/shimx64.efi was years older than the other files in /boot/efi/EFI/Boot/:

sudo ls -lah /boot/efi/EFI/Boot/

I then removed it and the upgrade worked smoothly:

sudo rm /boot/efi/EFI/Boot/shimx64.efi
sudo fwupdmgr update
5

Your Ubuntu Linux 20.04 LTS contains grub2 and other booting software in older versions, which are blacklisted in DBX version 217 due to security issues. Updating the DBX database in flash of your PC would result in your system to be excluded from booting for future (in UEFI secure-boot mode). This cannot be reverted!

Not a good idea to update to DBX version 217 unless you have updated e. g. to Ubuntu 22.04 LTS with a grub2 etc. which is not excluded from booting in DBX. fwupdmgr checks compatibility for you and then therefore denies to update the DBX to a version which would make your PC system inoperable.

Recommendations:

  1. Do not update and live with security risks
  2. Update Ubuntu to a current version like 22.04 LTS or 22.10 and then do the update to DBX version 217. This should work and minimize security risks.

Note: It would be nonsense to update to DBX version 217 and then boot your system with secure-boot disabled in UEFI-BIOS from that time. Then you would have to live with more security risks. This would arise further risks to other OS too. Return to 1) or 2).

Please be aware, that recommendation 2) will possibly exclude several other of your existing boot media like USB memory sticks and CDs etc. from booting in future. So make sure, you really want 2) or live some time with 1) until you are ready for 2).

1
  • I am trying to upgrade, $ sudo do-release-upgrade -d But I get this output: >Checking for a new Ubuntu release >Please install all available updates for your release before upgrading. Commented Nov 15, 2022 at 1:55
2

See: https://github.com/fwupd/fwupd/issues/5035 TL;DR Upgrade to the newest version of fwupd

3
  • 4
    Could you summarise that solution in your answer? If the webpage disappears, your answer won’t be useful to others. Thank you!
    – Will
    Commented Sep 17, 2022 at 21:33
  • It is a bug, maintainer is aware of it, current fwupd version is 1.7.5 needs a boost.
    – Gri Ma
    Commented Sep 21, 2022 at 7:44
  • @GriMa, is there anything I can do or just wait?
    – Py-ser
    Commented Sep 22, 2022 at 7:05
1

In my case moving the files fwupdmgr lists out of the /boot folder worked. I have moved from Ubuntu 20.04 to 22.04 some weeks ago and got this update of DBX listed.

In my case there were a lot of old files in the /boot/efi/boot-repair/log folder so I moved the whole log folder out of /boot area. Then "sudo fwupdmgr update" worked and I did "sudo update-grub" without rebooting. I guess this is the main thing: Do not reboot before you have done "sudo update-grub"

Then I rebooted and my holy machine comes to life again.

0

He said it is fixed: Fixed in Fixed in https://gitlab.com/fwupd/lvfs-website/-/merge_requests/1363 for future firmwares. Probably it is a save although annoying thing to ignore update request until Ubuntu fixed it.

1
  • So what should I get from that link? Could you elaborate the answer?
    – Py-ser
    Commented Sep 29, 2022 at 12:06
0

I was having the same issue. I just moved all of the offending files reported by the upgrade into a safe place outside of the boot folder. One you ensure everything works correctly, you can delete the files you moved.

In your case it would be something like this:

$ sudo mv /boot/efi/EFI/Boot/shimx64.efi ~/Documents
$ sudo fwupdmgr update

If you get another error after running fwupdmgr move the file it complains about to your Documents folder. I had to move 3 "Blocked Executable" files before the update utility worked. Once the update succeeds, make sure grub is up to date:

$ sudo update-grub

Now you can reboot and everything should work as normal. You can delete the efi folders quarantined in your Documents folder.

1
  • Doing the same thing broke my boot. Had to boot-repair from a live USB do be able to start my computer afterwards. After this, all seems to be working and this UEFI dbx update isn't proposed anymore.
    – RobinC
    Commented Oct 26, 2022 at 10:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .