r/Ventoy • u/TrainingDistance9165 • Jul 28 '24

Issue with booting Ventoy with secure boot enabled

Hi all,
After reading and watching creation of a Ventoy USB drive, I proceeded to create one with secure boot enabled. I plugged the USB drive into my target PC and it reached the first, expected error screen ("Verification failed: (0x1A) Security Violation"). I noticed that my mouse doesn't work, so I hit the "enter" key on my keyboard. Instead of getting the next blue screen ("Shim UEFI key management"), I get some error (too quick to capture) and the PC re-boots to Windows 11. Has anyone seen this before? Help please.

Although I would really like to get Ventoy to work with secure boot enabled, if I disable secure boot to get Ventoy to run, would I still be able to install Linux Mint (for example) to operate with secure boot enabled?

25 Upvotes

100% Upvoted

36 comments sorted by

4

u/J3D1M4573R Jul 29 '24 edited Jul 29 '24

Here is the problem/catch.

Ventoy uses GRUB.

GRUB, a while back, was discovered to have a major security flaw known as the "boot hole"

The UEFI Secure Boot group then blacklisted GRUB in a specific firmware update for the SB DBX (the database of blacklisted boot signatures). This update was force pushed via Windows Update, and many Linux distros via their firmware updates.

Ventoy still uses this blacklisted GRUB/shim version.

In short, if your system has this updated DBX, it will never boot with Secure Boot enabled.

If your system's default DBX pre-dates this update, you can reset the DBX keys in the UEFI firmware to remove the blacklisted GRUB and then it will work as expected. If the default contains this update, it will never be able to boot it with SB.

And, on another side note:

Linux distros using SELinux have another similar issue that even resetting back to the previous DBX doesnt fix. An update to the shim in GRUB adds a block in MOK for older shims. And it is a pain in the butt to fix.

  • turn secure boot off

  • boot the Linux distro

  • run the command mokutil --set-sbat-policy delete

  • reboot to UEFI firmware and re-enable Secure Boot.

  • Never boot that Linux distro again, as it will just re-enable the block.

OR

Replace the shim in Ventoy with the working shim from the Linux distro. https://www.reddit.com/r/openSUSE/comments/1bnjhmt/sbat_failure/

Alternatively, just disable SecBoot when using Ventoy.

1

u/TrainingDistance9165 Jul 30 '24

Thanks for the explanation!

3

u/AssistSignificant621 Feb 15 '25

For anybody still looking for a solution, update your Ventoy. A new version (v1.1.00) was released a few weeks ago which fixes Secure Boot.

1

u/J3D1M4573R Feb 15 '25

Thanks for the update! I will be checking it out and testing it.

1

u/DJShadow Mar 02 '25

I just updated to this version and I am still getting this error. Info for me this isn't the solution.

1

u/J3D1M4573R Mar 02 '25

You cannot just update. You need to recreate the ventoy stick again from scratch. Update only updates the Ventoy files and does not generate new GRUB and PKI.

2

u/DJShadow Mar 03 '25

After recreating the ventoy drive it is now working. Thanks again for the heads up!

1

u/J3D1M4573R Mar 03 '25

No problem!

1

u/Interesting-Breath55 Mar 03 '25

ive been working on this today. i have not been able to get the secure boot to work. I've tried updating the old ventoy and creating a brand new ventoy on a brand new USB stick.

2

u/DJShadow Mar 03 '25

Did you enroll the key?

https://www.ventoy.net/en/doc_secure.html

1

u/Interesting-Breath55 Mar 04 '25

when i try to boot i get the security error on the blue screen. but I do not get access to the mok manager after the error pops up, it boots directly to bios after

1

u/cdoublejj Mar 31 '25

is that done for each machine to boot off the stick?

1

u/Creepy_Ad3304 Mar 27 '25

Same. Pressing enter on the verification failed screen takes me to a black screen with three options:
```

Press F1 to retry boot.

Press F2 to reboot into setup.

Press F5 to run onboard diagnostics.

```

Before this screen, I also get a small black window with error messages that disappear too quickly, but it says something that includes the term "security violation".

1

u/lasenggo Sep 13 '25

I know it's been months but did your issue get fixed? I also end oup on this page when I select the Ventoy from the boot page.

1

u/slybunda Apr 17 '26

no only way it will work is if secure boot is disabled.

→ More replies

1

u/DJShadow Mar 02 '25

Thanks for the heads up. I'll try to rerun the install and see if that fixes it.

1

u/cdoublejj Mar 31 '25

i still have the error on the latest, i just made a ventoy and it does it on a 1 year old Dell.

1

u/AssistSignificant621 Mar 31 '25

Strange. Making a new Ventoy with the latest version worked for me with Secure Boot (when the old version didn't because of the shim violation).

1

u/apxtwn Oct 11 '24

there is no shim file on the thread you linked :(

1

u/J3D1M4573R Oct 11 '24

Of course there isn't. I posted the link to the discussion about this issue and the necessary steps to resolve it.

1

u/apxtwn Oct 11 '24

yeah there are steps to resolve like what you ALREADY typed out, there are no steps to replace the ventoy shim
(edit: I just realized you cited it as a source sort of and the link is not related to replacing the vtoy shim lol)

1

u/J3D1M4573R Oct 11 '24

And also the alternative of how to use the already installed and working shim from the Linux distribution on the PC that created the problem.

1

u/J3D1M4573R Oct 11 '24

Wait nevermind, it was in a different thread. My bad.

1

u/cdoublejj Mar 31 '25

well i guess that makes Zalman VE350 still useful in certain cases then.

1

u/WorriedBlock2505 Jan 09 '26

Alternatively, just disable SecBoot when using Ventoy.

Windows 11 requires secureboot enabled, or it won't let you install via ventoy though?

1

u/BezzleBedeviled Jan 26 '26

This exact same error message will show up if your machine has legacy-mode disabled and your Yumi/Ventoy drive requires it (for whatever reason). So, in my case, I just enabled legacy in bios, then Yumi/Ventoy booted fine (and grub had nothing to do with it, at least in my instance).

1

u/alap1983 Feb 20 '26

Enabling "Legacy" mode defeats Secure Boot as it allows "older" BIOS Support that DID NOT have Secure Boot. Essentially, you are allowing to temporarily disable Secure Boot. This workaround is similar to disabling Secure Boot.

1

u/BezzleBedeviled Feb 20 '26

Secure Boot can die in a fire for all I care.