Public bug reported:

I can reproduce a boot failure caused by shim 15.8 when the Secure Boot
dbx variable is large.

System information:

- Distribution: Linux Mint 22.2, based on Ubuntu 24.04 Noble
- Motherboard: MSI Z270 GAMING M3 (MS-7A62)
- CPU: Intel Core i7-7700
- Firmware vendor: American Megatrends Inc.
- Firmware version: 1.00
- Firmware date: 2016-11-30
- TPM: Intel PTT / TPM 2.0 enabled
- Secure Boot: enabled
- Dual boot: Windows 11 Pro and Linux Mint 22.2

Package version:

shim-signed:
  Installed: 1.58+15.8-0ubuntu1
  Candidate: 1.58+15.8-0ubuntu1
  Repository: Ubuntu Noble main

The firmware Forbidden Signatures / dbx variable grew to approximately:

- Size: 18036 bytes
- Entries: 374
- Source: Mixed

On the following Linux boot, shim failed before GRUB was displayed with:

Could not create MokListRT: Volume Full
Could not create MokListXRT: Volume Full
Could not create SbatLevelRT: Volume Full
Could not create MokListTrustedRT: Volume Full
Something has gone seriously wrong: import_mok_state() failed: Volume Full

Expected result:

shim should display a warning when the TPM event log is full and
continue booting, because the TPM extend operation has already occurred.

Actual result:

shim treats EFI_VOLUME_FULL as fatal and prevents Linux from booting.

Workaround:

Deleting only the dbx / Forbidden Signatures variable in the UEFI setup
allows Linux to boot immediately again.

Secure Boot remains enabled, the enrolled MOK remains present, and
signed NVIDIA and VirtualBox kernel modules load normally.

Re-enrolling the large dbx causes the failure to return.

The behavior matches this upstream issue:

https://github.com/rhboot/shim/issues/654

The upstream fix appears to be:

https://github.com/rhboot/shim/pull/657

The fix changes EFI_VOLUME_FULL handling so that a full TPM event log
produces a warning instead of aborting the boot process.

Ubuntu Noble still provides:

shim-signed 1.58+15.8-0ubuntu1

Please consider backporting the upstream EFI_VOLUME_FULL handling fix to
Ubuntu 24.04 Noble's shim/shim-signed packages.

A temporary workaround on this machine is:

- Secure Boot enabled
- TPM 2.0 enabled
- dbx cleared
- Windows Secure-Boot-Update scheduled task disabled

I understand that clearing dbx reduces Secure Boot revocation protection
and is not an appropriate permanent solution.

** Affects: shim-signed (Ubuntu)
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2161200

Title:
  shim 15.8 on Ubuntu Noble fails to boot with EFI_VOLUME_FULL when dbx
  is large

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/shim-signed/+bug/2161200/+subscriptions


-- 
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to