640
submitted 2 months ago by pnutzh4x0r@lemmy.ndlug.org to c/linux@lemmy.ml

Last Tuesday, loads of Linux users—many running packages released as early as this year—started reporting their devices were failing to boot. Instead, they received a cryptic error message that included the phrase: “Something has gone seriously wrong.”

The cause: an update Microsoft issued as part of its monthly patch release. It was intended to close a 2-year-old vulnerability in GRUB, an open source boot loader used to start up many Linux devices. The vulnerability, with a severity rating of 8.6 out of 10, made it possible for hackers to bypass secure boot, the industry standard for ensuring that devices running Windows or other operating systems don’t load malicious firmware or software during the bootup process. CVE-2022-2601 was discovered in 2022, but for unclear reasons, Microsoft patched it only last Tuesday.

...

The reports indicate that multiple distributions, including Debian, Ubuntu, Linux Mint, Zorin OS, Puppy Linux, are all affected. Microsoft has yet to acknowledge the error publicly, explain how it wasn’t detected during testing, or provide technical guidance to those affected. Company representatives didn’t respond to an email seeking answers.

top 50 comments
sorted by: hot top controversial new old
[-] doctortofu@reddthat.com 155 points 2 months ago

So, no booting into Windows until this is fixed then? Fine by me. Hell, might actually make me uninstall it completely and free some disk space...

[-] BaalInvoker@lemmy.eco.br 63 points 2 months ago

Well... It's the opposite... People affected by this issue could not boot Linux...

[-] doctortofu@reddthat.com 97 points 2 months ago* (last edited 2 months ago)

Right, but you have to boot into Windows first to even get the update in the first place...

load more comments (5 replies)
[-] todd_bonzalez@lemm.ee 141 points 2 months ago

Hey Microsoft: Windows is yours, GRUB is mine. I don't give a shit if GRUB is vulnerable, I'll fix that myself if I choose to.

Mind your own fucking business. The most you should ever do is let me know about it, not try to patch things you aren't responsible for...

load more comments (4 replies)
[-] rockSlayer@lemmy.world 121 points 2 months ago

CVE-2022-2601 was discovered in 2022, but for unclear reasons, Microsoft patched it only last Tuesday.

I respect their journalistic integrity for not speculating, but it was definitely because the NSA was exploiting it.

[-] porous_grey_matter@lemmy.ml 68 points 2 months ago* (last edited 2 months ago)

Ehhh that's likely enough, but Microsoft is also just shit at fixing things

load more comments (4 replies)
load more comments (4 replies)
[-] hobbsc@lemmy.sdf.org 120 points 2 months ago

"secure" boot, the industry standard for ensuring that devices don't run software other than Windows during the bootup process

FTFY

load more comments (1 replies)
[-] delirious_owl@discuss.online 83 points 2 months ago

Secure Boot is bullshit anyway

[-] possiblylinux127@lemmy.zip 31 points 2 months ago

It is fine if you only accept signatures from yourself. However, that's a lot of work as you need to sign everything.

[-] delirious_owl@discuss.online 17 points 2 months ago

Good luck replacing the PKI on your system's Secure Boot firmware. Most platforms probably don't support it and have no documentation

load more comments (5 replies)
[-] lily33@lemm.ee 82 points 2 months ago* (last edited 2 months ago)

I'm confused - why is Microsoft trying to - or expected to, by the article authors - patch a vulnerability in GRUB?

[-] Peffse@lemmy.world 102 points 2 months ago

It was supposed to patch Secure Boot, not demolish GRUB.

That's why it's a problem.

[-] ReversalHatchery@beehaw.org 15 points 2 months ago

I was interested too. It seems Microsoft has released a patch that blacklists vulnerable grub versions from being able to be secure booted even if they are signed properly:

https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2022-2601

The link was at the top of the article.

Maybe this update somehow affects your UEFI firmware, and it installs a list in there?

[-] Reddfugee42@lemmy.world 12 points 2 months ago

It was a Windows vulnerability that allowed an exploit box GRUB

[-] scorp@lemmy.ml 13 points 2 months ago

it was a vulnerability in Grub tho, i understand the Microsoft hate but not to the extant of lying.

load more comments (1 replies)
load more comments (1 replies)
[-] Zink@programming.dev 57 points 2 months ago

I get to dual boot at work (I run mint btw) and the only reason I ever boot into windows every week or three is to make sure it doesn’t get so out of date that it gets booted from the network.

I guess it’s time to stop that shit! Having windows available is not worth the risk of messing up my work machine. Hell I’m tempted to nuke that windows partition and double the size of my /home partition!

Though I will give Microsoft credit that m365 stuff, including video calls in Teams, work great using the web versions in Firefox. That’s even with the security and privacy stuff cranked up. I only white listed those sites for cookies and local storage for convenience.

load more comments (3 replies)
[-] northmaple1984@lemmy.ca 54 points 2 months ago

This sort of ridiculousness is why I got two seperate drives (needed the extra space anyways) and choose which one to boot from the mobo EFI menu.

[-] Microplasticbrain@lemm.ee 19 points 2 months ago

Yep, I don't even fuck with grub since that has fucked me over in the past too, I just go into the fucking bios and select it manually lmao

[-] Kongar@lemmy.dbzer0.com 52 points 2 months ago

I just tried installing this patch tonight on my windows drive - not because I use windows, just to… you know… keep it updated and secure I guess.

It literally won’t even install. It just fails out every time. Whatever. Microsoft releases so many bad patches lately. WTH are they even doing over there? Windows used to be king and they’ve been screwing it up since 8 came out.

[-] floofloof@lemmy.ca 67 points 2 months ago* (last edited 2 months ago)

Microsoft fired its entire QA team 10 years ago, and shifted the responsibility for testing onto developers. They also got rid of their dedicated hardware lab where software would be tested on many different hardware combinations.

I have worked in two companies that made the same move of firing QA, and in both the quality of the released software took a marked dive. (In neither company did senior management admit that what everyone warned them would be a mistake was a mistake. Instead they blamed developers.)

These days Microsoft's testing team is whichever users receive each update first. They rely on users and telemetry to do what should be the job of dedicated testers.

[-] suburban_hillbilly@lemmy.ml 27 points 2 months ago

This is hardly a new thing for MS. One of the first emails I remember getting when I got to college back in 2003 was from campus IT begging people not to install the latest XP update because it reenabled a vulnerability to existing malware.

[-] Zoop@beehaw.org 13 points 2 months ago

Microsoft fired its entire QA team 10 years ago, and shifted the responsibility for testing onto developers. They also got rid of their dedicated hardware lab where software would be tested on many different hardware combinations.

That...makes SO much sense and explains a lot! Thanks for mentioning it.

[-] mactan@lemmy.ml 44 points 2 months ago

windows update can and will always find your dual boot eventually and break it

load more comments (3 replies)
[-] mortimer@lemmy.world 43 points 2 months ago* (last edited 2 months ago)

So glad I recently removed Windows from my former dual boot system completely. Was sick of getting errors during Linux boot up after running Windows for that one piece of software I couldn't get to work in Wine or Bottles. The culprit I assumed was Windows updates, which I attempted to disable through the registry on several occasions. It would work for a short period and then Microsoft, in all their wisdom, would just reenable updates because clearly they know better than I what I want my system to do. The last time it happened was the final straw for me when I wanted to boot into Windows briefly only to be left waiting half an hour for Windows to apply updates on shutdown. Pissed me off so much I killed the power mid-update, booted up a live partition tool and wiped Windows off my system completely (updating the grub to remove dual boot). That's when I discovered that not properly shutting down Windows would mark my other drives dirty and make them read only. To fix this I ended up having to insert Windows installation media and pretend like I wanted to reinstall Windows 10 again. Once it got to the stage when it was about to write to the drive I cancelled the installation and rebooted back into Linux. Voilà! Could write to my drives again. To hell with Windows. I'd rather live without that one piece of software and have my system do what I want it to do rather than it second guess me and disregard my instructions. This whole automatic update thing really boiled my piss. At least with Linux I can choose to apply updates when it's convenient for me to do so.

load more comments (8 replies)
[-] captain_aggravated@sh.itjust.works 40 points 2 months ago

Has SecureBoot ever accomplished anything vaguely resembling security?

[-] theroff@aussie.zone 18 points 2 months ago

Securing proprietary hardware against peeps installing alt OSes

[-] phoenixz@lemmy.ca 14 points 2 months ago

Yeah, it made installing Linux more difficult, so it actually lowered computer security by pushing you to use windows

load more comments (1 replies)
[-] rem26_art@fedia.io 39 points 2 months ago

Maybe its finally time to get rid of my dual boot. I haven't used the windows side in like half a year...

[-] henfredemars@infosec.pub 26 points 2 months ago

I was shocked how little I need Windows. I went dual boot install but just... never booted Windows again. My games work. I'm happy. Why should I boot Windows?

Really I should just remove Windows but I'm lazy.

load more comments (5 replies)
[-] Wispy2891@lemmy.world 37 points 2 months ago

If it's a Linux problem why Microsoft has to patch it?

It's like if someone gives you a ride to the hospital and the doctor treats him instead of you

[-] my_hat_stinks@programming.dev 24 points 2 months ago

I'm not sure I follow that analogy, if you get a ride to a hospital you don't expect it to lock off all other destinations. What happens in the hospital is irrelevant.

From reading the article, this is more like if you walk into a hotel and they burn down your house so you have no choice but to stay. I suppose in theory you could argue in very bad faith that this is a problem with the house since it's the house that burned, but in reality the problem is the fact they're the ones who started the fire.

load more comments (1 replies)
[-] endofline@lemmy.ca 21 points 2 months ago

Because people cannot block darn windows updates. Its a real malware only allowed by law

[-] possiblylinux127@lemmy.zip 16 points 2 months ago

Microsoft: you can have security updates

Users: good

Microsoft: just keep in mind they will make major changes and will totally change the desktop and settings.

Users: wait what Microsoft Edge opens

load more comments (1 replies)
[-] darkmogool@feddit.org 32 points 2 months ago

booting into windows?

it's been 84 years…

[-] dharmacurious@slrpnk.net 31 points 2 months ago

Y'all, help a dummy out. I dual boot windows and Fedora. I only keep windows around for a very few college classes that require for screenwriting software. I have not booted into windows in months. I have a screenwriting class coming up in a week.

How worried should I be? I am not great with computers, I run fedora mostly because I support the philosophy of Linux, less for the techy stuff. Please advice, Linux people. I'm scurred.

[-] nehal3m@sh.itjust.works 19 points 2 months ago

Does that screenwriting software require a lot of performance? You might opt to install Windows into a virtual machine, as described here: https://www.windowscentral.com/how-setup-windows-10-virtual-machine-linux

Essentially you're using some software to emulate a computer inside your computer that can run any operating system you want. It doesn't need to touch your actual operating system installation, you can treat it as just another program. For your use case that sounds appropriate; you occasionally need to run specific software that has low system requirements. This way you can do that without risking Microsoft borking your Linux machine any time it feels like it.

load more comments (5 replies)
load more comments (47 replies)
[-] Liz@midwest.social 21 points 2 months ago

“The SBAT value is not applied to dual-boot systems that boot both Windows and Linux and should not affect these systems,” the bulletin read. “You might find that older Linux distribution ISOs will not boot. If this occurs, work with your Linux vendor to get an update.”

Excuse me, those are the opposite of each other.

[-] chanteoma@lemmy.ml 18 points 2 months ago

I use Debian and I also was affected by this Windows update. I was able to boot by disabling secure boot. I also found this option that apparently fixes the problem by changing the sbat policy using mokutil. But I haven't tried it out yet. Has anyone got any luck with something else besides disabling secure boot?

load more comments (2 replies)
[-] asexualchangeling@lemmy.ml 17 points 2 months ago* (last edited 2 months ago)

At this point I literally only have windows installed for potential future PCVR Plans (not just steam games either, at least 2 are exclusive to the Oculus launcher) does anyone out there know if there's a way to run Oculus VR games without a windows drive? I'm using a quest 2

If it was just steam games I would just try ALVR, but lone echo 1 & 2 are exclusive

load more comments (6 replies)
[-] JasonDJ@lemmy.zip 16 points 2 months ago

They had to know this would happen, right?

Like, they didn't think to test with a dual booting system? Wtf?

Where do they even get off fixing a bug in grub?

[-] interdimensionalmeme@lemmy.ml 15 points 2 months ago

Always install rEFInd Always keep a rEFInd USB stick around Basic Computer 101

load more comments (5 replies)
[-] laurelraven@lemmy.blahaj.zone 14 points 2 months ago

It ain't done til GRUB don't run?

[-] UnH1ng3d@lemmy.world 13 points 2 months ago

😈😈 Finally an advantage to using rEFInd 😈😈

load more comments (2 replies)
[-] thingsiplay@beehaw.org 12 points 2 months ago

CVE-2022-2601 was discovered in 2022, but for unclear reasons, Microsoft patched it only last Tuesday.

load more comments
view more: next ›
this post was submitted on 21 Aug 2024
640 points (99.2% liked)

Linux

47970 readers
1060 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago
MODERATORS