Unable to update UEFI dbx

English Hardware
1

On my laptop, with Tumbleweed, discover do not update UEFI (list of revoked certificates) via lvfs. No error messages, simply update all was disabled and near immediately was enabled again.

2

I’m going to guess that if you run (as root):

fwupdmgr update

You’ll see something like this:

# fwupdmgr update
╔══════════════════════════════════════════════════════════════════════════════╗
║ Upgrade UEFI dbx from 371 to 20241101?                                       ║
╠══════════════════════════════════════════════════════════════════════════════╣
║ This updates the list of forbidden signatures (the "dbx") to the latest      ║
║ release from Microsoft.                                                      ║
║                                                                              ║
║ An insecure version of Howyar's SysReturn software was added, due to a       ║
║ security vulnerability that allowed an attacker to bypass UEFI Secure Boot.  ║
║                                                                              ║
╚══════════════════════════════════════════════════════════════════════════════╝
Perform operation? [Y|n]: Y
Writing…                 [                                       ]
failed to write-firmware: failed to write data to efivarsfs: Error writing to file descriptor: No space left on device

If that’s the case, then you need to go into your EFI BIOS and reset the certificate database to the default. You probably will want to disable secure boot while doing this (just in case a signed module’s certificate isn’t in the stock database on your system).

How you do that will depend on the BIOS - you’ll need to check the manufacturer’s documentation.

Once that’s done, you should be able to run the fwupdmgr command again.

3

Thanks. Error message was different:

Verifying…               [                                       ]
failed to write-firmware: Blocked executable in the ESP, ensure grub and shim are up to date: failed to load /boot/efi/EFI/Boot/Shell.efi: failed to read section 0x2: invalid section name

I test Shell exist and Shell.efi exists.

4

Sounds like a problem with the file itself; my setup looks different (that file doesn’t appear to exist), so hopefully someone else with a similar setup can provide some guidance here.

5

I remind myself I probably install EFI Shell, but I am not 100% sure. To start EFI shell, I must disable secure boot, I remember. So I try to remove this file. Maybe it does not contain some section with digital signature?

6

Really? I wonder…

7

Yes. My motherboard does not have EFI Shell and it allows to to malicious stuff, so disabling SecureBoot was probably necessary. I move this file to different location and now everything works.

1 Like
8

Until today I also had a problem with Upgrade UEFI dbx to 371 when using the command fwupdmgr update.
After using the extended version of the command fwupdmgr update --force
the upgrade was successful.

1 Like
9

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.