Secure Boot DBX configuration refuses to update

Ask Fedora
,
1

image
image620×165 11.4 KB

Every time I attempt to update the secure boot DBX configuration in software, it always appears again.

Have you tried sudo fwupdmgr refresh & sudo fwupdmgr update?

Yes, I’ve tried both, twice. no promising results.

Have you reset secure boot keys in the BIOS?

No, I only have the option to clear secure boot keys. I have no expertise with this, so I am unfamiliar with what to do.

I am not in any rush to fix things; any help will be appreciated.

2

What is the output of the sudo fwupdmgr update command?

3 
Upgrade UEFI dbx from 20230501 to 20260402?                                  ║
╠══════════════════════════════════════════════════════════════════════════════╣
║ This updates the list of forbidden signatures (the "dbx") to the latest      ║
║ release from Microsoft.                                                      ║
║                                                                              ║
║ Some insecure bootloaders were added, due to security vulnerabilities that   ║
║ allowed an attacker to bypass UEFI Secure Boot. The additional entries were  ║
║ from:                                                                        ║
║                                                                              ║
║ • Baramanudi Management Suite                                                ║
║ • EAZ EasyFix                                                                ║
║ • Finland Matriculation Examination Board                                    ║
║ • NTC IT ROSA Linux                                                          ║
║ • PC-Doctor                                                                  ║
║ • Spyrus WTGCreator                                                          ║
║ • WhiteCanyon blancco                                                        ║
║ • Some ancient shim releases for OpenSUSE, Oracle and Red Hat                ║
║Preformatted text

After i typed "N’ after “Perform operation? [Y|n]:” i got:

Devices with the latest available firmware version:
 • Windows UEFI CA
4

What happens if you type “Y” to allow it to do the update?

5

It updates as it would if i updated via Software

6

Problem solved then?

7

No, I mean after I update it, it keeps giving me the same update to download in Software.

8

Have had a similar issue in the past. First make sure your bios is up to date. Then try using the firmware app on flathub, strangely this worked for me when other options did not:

9

From my knowledge my BIOS is up to date, but firmware still didn’t work for me, somehow.

10

Software maybe using out of date information.
Once it updates I hope you will stop seeing the update offered.

11

Maybe it’s just a bug that hopefully will be fixed in the future; it’s not giving me any trouble considering it’s just a secure boot update, so I’m in no rush to fix it. I will, however, have to address it sometime soon, which sucks a bit.