Category: VMware

“SECUREBOOT: Image DENIED.” – Virtual Machine with Windows Server 2022 KB5022842 (OS Build 20348.1547) configured with secure boot enabled not booting up (90947)

“SECUREBOOT: Image DENIED.” – Linux VMs created with Hardware version 20 will fail to start installation when Secure Boot is enabled (88737)
Reference error “SECUREBOOT: Image DENIED.” for Linux VMs

Important KB90947 Symptoms

After installing Windows Server 2022 update KB5022842 (OS Build 20348.1547), guest OS can not boot up when virtual machine(s) configured with secure boot enabled running on vSphere ESXi 6.7 U2/U3 or vSphere ESXi 7.0.x.

In VM vmware.log, there is ‘Image DENIED’ info like the below:

2023-02-15T05:34:31.379Z In(05) vcpu-0 - SECUREBOOT: Signature: 0 in db, 0 in dbx, 1 unrecognized, 0 unsupported alg.
2023-02-15T05:34:31.379Z In(05) vcpu-0 - Hash: 0 in db, 0 in dbx.
2023-02-15T05:34:31.379Z In(05) vcpu-0 - SECUREBOOT: Image DENIED.
To identify the location of vmware.log files:
  1. Establish an SSH session to your host. For ESXi hosts
  2. Log in to the ESXi Host CLI using root account.
  3. To list the locations of the configuration files for the virtual machines registered on the host, run the below command:
#vim-cmd vmsvc/getallvms | grep -i "VM_Name"
  1. The vmware.log file is located in virtual machine folder along with the vmx file.
  2. Record the location of the .vmx configuration file for the virtual machine you are troubleshooting. For example:
/vmfs/volumes/xxxxxxxx-xxxxxxx-c1d2-111122223333/vm1/vm1.vmx
/vmfs/volumes/xxxxxxxx-xxxxxxx-c1d2-111122223333/vm1/vmware.log

Resolution

Currently there is no resolution for virtual machines running on vSphere ESXi 6.7 U2/U3 and vSphere ESXi 7.0.x. However the issue doesn’t exist with virtual machines running on vSphere ESXi 8.0.x.

Note: vSphere ESXi 6.7 is End of general Support. For more information, see The End of General Support for vSphere 6.5 and vSphere 6.7 is October 15, 2022.

Workaround

There are three methods to avoid this issue

  1. Upgrade the ESXi Host where the virtual machine in question is running to vSphere ESXi 8.0
  2. Disable “Secure Boot” on the VMs.
  3. Do not install the KB5022842 patch on any Windows 2022 Server virtual machine until the issue is resolved.

See the Microsoft article for details on the updates within the patch release

To disable virtual machine “Secure Boot “option, please follow the below steps:

  1. Power off the VM.
  2. Right-click the virtual machine and click Edit Settings.
  3. Click the VM Options tab.
  4. Under Boot Option, uncheck the “Secure Boot enabled“

Related Information

Uninstalling the KB5022842 patch will not resolve the issue. If the Virtual machine has already been updated, then the only available options are
 

  1. Upgrade the ESXi Host where the virtual machine in question is running to vSphere ESXi 8.0
  2. Disable “Secure Boot” on the VMs.

IP Address Overlap in NSX – An NSX Blog

IP Address Overlap in NSX – An NSX Blog

Introduction: One of my NSX peers was recently working on an IP address overlap issue that helped lead to a better understanding of routing behaviour within an NSX environment. The Scenario: In this corner case scenario there is IP address overlap between these two subnets: The NSX environment, [..]

VMware Social Media Advocacy

Create Windows 11 Virtual Appliance using Tiny…

Create Windows 11 Virtual Appliance using Tiny…

I recently came to learn about a really cool project called Tiny 11 which is a stripped down version of Windows 11 Pro 22H2 that can run with just 2GB of memory and 8GB of storage. While you would probably not use this for production workloads, it could be interesting for those with homelabs and […]

VMware Social Media Advocacy

“SECUREBOOT: Image DENIED.” – Linux VMs created with Hardware version 20 will fail to start installation when Secure Boot is enabled (88737)

“SECUREBOOT: Image DENIED.” – Virtual Machine with Windows Server 2022 KB5022842 (OS Build 20348.1547) configured with secure boot enabled not booting up (90947)
Reference “SECUREBOOT: Image DENIED.” for Windows Server 2022
How ESXi Uses UEFI Secure Boot

Important 88737 Symptoms

The installation of the Operating System image will be denied and “SECUREBOOT: Image DENIED.” will be reported in vmware.log.

Below goes the list of the impacted Linux Operating Systems.

  • RHEL 8.0~8.4, 7.x 
  • CentOS 8.0~8.5, 7.x
  • Oracle Linux 8.0~8.3, 7.x
  • AlmaLinux 8.4    
  • Rocky Linux 8.4    
  • Photon OS 4.0GA, 3.0 GA & Rev 2 & Rev 3, 2.0    
  • Ubuntu LTS 20.04~20.04.4, 18.04~18.04.5 and earlier
  • Ubuntu Non-LTS 21.04, 20.10, 19.10, 19.04, 18.10 and earlier     
  • Debian 10.9 and earlier     
  • SLE 12SP0~SP5, 15SP0-SP2

Cause

This is caused due to the Secure Boot deny list (dbx) is updated to prevent vulnerable bootloaders from being used. For more information, refer to VMware response to GRUB2 security vulnerability CVE-2020-10713 (80181)

Resolution

  1. Create the SecureBoot Virtual Machine with Hardware version 19 (or earlier).
  2. After the installation is completed, update the vulnerable bootloader of the VM to a newer and fixed version, refer to VMware response to GRUB2 security vulnerability CVE-2020-10713 (80181)
  3. Upgrade the Virtual Machine’s Hardware version to 20.

Workaround

Create the Virtual Machine with Secureboot disabled instead.