41

It seems that with the recent Windows Update, for systems that have dual-boot is not letting grub start, showing the message: Verifying shim SBAT data failed: Security Policy Violation.

Does anyone know what can I do to fix this?

1
  • I got this on an old installation of openSUSE Tumbleweed after booting a live USB of Fedora 40.
    – RokeJulianLockhart
    Commented Sep 12 at 12:40

4 Answers 4

Reset to default
48

Okay, I managed to fix it!

I followed the instructions in: https://discourse.ubuntu.com/t/sbat-revocations-boot-process/34996

In case this can help anyone, here is what worked for me:

  1. Disable Secure Boot in BIOS
  2. Log into your Ubuntu user and open a terminal
  3. Delete the SBAT policy with: sudo mokutil --set-sbat-policy delete
  4. Reboot your PC and log back into Ubuntu to update the SBAT policy
  5. Reboot and then re-enable secure boot in your BIOS.

Edit #1: This is only available for versions after Ubuntu 22.10

Edit #2: I also followed this guide recommended by user Mr. T which modifies the Windows Registry to no longer do SBAT modifications in future updates.

In a Windows CMD with admin permissions run the following command:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\SBAT /v OptOut /d 1 /t REG_DWORD
17
  • 5
    Hmm... I'd say better yet is to move Windows into a Virtualbox VM; similar problems will disappear forever. Even better; use it only for what is absolutely necessary and nothing else.
    – Hannu
    Commented Aug 15 at 15:58
  • 3
    For step 4. Is the SBAT policy updated automatically after restarting Ubuntu or should I do it manually?
    – Jose Miralles
    Commented Aug 17 at 14:28
  • 3
    @JoseMiralles logging back into Ubuntu updates the policy automatically.
    – TommyPeanuts
    Commented Aug 18 at 8:06
  • 3
    Just to clarify, these actions will disable SBAT protection. Can you restore sbat-policy to latest? And will Ubuntu 24.04.1 update Shim/Grub bootloader to follow requirements of new SBAT policy or everyone with Ubuntu 24.04 need to update Shim/Grub apart from Ubuntu after 24.04.1 installed?
    – ubuntu_ambassador
    Commented Aug 18 at 15:38
  • 1
    Thanks this worked in Debian 12 as well for me
    – drussey
    Commented Aug 23 at 5:08
4

This is taken from Akeo's answer here.

I think your question is easy to answer:

  1. As its version number indicates, Ubuntu 24.04 was released in April 2024.
  2. The Microsoft update you appear to be talking about (KB5041160) was released in August 2024.

We should therefore assume that if a Windows update from August 2024 talks about fixing a Secure Boot vulnerability in the UEFI Shim, it is likely to apply to the UEFI Shim used in an ISO that was released 4 months prior, such as the one used in the Ubuntu 24.04 ISO.

Now, Ubuntu does tend to produce refreshes of major releases, where they update the software (and can update bootloaders as well), which they will suffix with a .1, .2 etc. The24.04.1 refresh was not released until the end of August 2024, so the 24.04 ISO you are using is still the April 2024 one, which most likely uses a Shim that has not been patched for the vulnerability that the Microsoft August update is trying to address (and therefore prevents vulnerable Shim bootloaders to run through SBAT).

And, as you mention, since you do not run a dual boot installation, the update did install the SBAT update on your system, thereby most likely preventing any Shim based Linux boot media, that uses a pre 2024.08 Shim, from booting.

Try using the Ubuntu 24.04.1 ISO and please report back how you go!

2

Anther solution to this issue is to disable secure boot completely in UEFI/BIOS.

2
  • in my EXO system, at boot it show a message to press F7 and after pressing F7 and ENTER to the password, it get into Windows directly
    – lifeisaquestion
    Commented Aug 18 at 23:31
  • Great, easy solution, however if you have BitLocker enabled on your Windows System Volume, you now have an Ubuntu-only laptop.
    – AlMo320
    Commented Sep 10 at 15:34
0

The shim SBAT data failed error means that Shim has blocked itself from executing because it found its own version on the SBAT block list. The SBAT block list is essentially a list of software versions that have security vulnerabilities and hence shouldn't be run (for details, see What is SBAT and why does everyone suddenly care?). In particular, the SBAT list was updated by Microsoft on 20th August 2024 to block Shim version 15.7 because of the CVE-2023-40547 remote code execution vulnerability.

The solution to this is to upgrade Shim to the latest version 15.8.

First turn off Secure Boot in the EFI firmware and boot your Linux install (you can re-enable Secure Boot after upgrading the Shim). The following commands must be run as root in a terminal.

Check efibootmgr -v so see what your boot order is, and which EFI path is executed - probably /boot/efi/EFI/ubuntu/shimx64.efi, but if your install is on a removable drive it might be /boot/efi/EFI/boot/bootx64.efi (if you are running systemd-boot or Debian or something else then look in /boot/efi/EFI/*).

To check the version of the installed Shim, run:

# strings /boot/efi/EFI/ubuntu/shimx64.efi | grep '$Version:'
$Version: 15.7 $

If the version is 15.7 (as above), then you must upgrade to 15.8. You can do this automatically by upgrading the shim with apt:

apt update
apt upgrade --reinstall shim-signed

Or manually by just copying the newer shim over the old one:

# cp /usr/lib/shim/shimx64.efi.signed /boot/efi/EFI/ubuntu/shimx64.efi

Now check the Shim version:

# strings /boot/efi/EFI/ubuntu/shimx64.efi | grep '$Version:'
$Version: 15.8 $

Reboot and re-enable Secure Boot in the EFI firmware. Everything should now work.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .