Per Microsoft, "You might find that older Linux distribution ISOs will not boot."

I guess their definition of "older Linux distribution ISOs" includes the current Ubuntu and Debian ISOs.

https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2022-2601

While Microsoft claims "The SBAT value is not applied to dual-boot systems that boot both Windows and Linux", is this always true?

If I have a Windows system that I sometimes boot into Linux from a USB drive, will Windows Update be able to detect this? Of course not. What if I use some sort of other unexpected "dual boot" mechanism? Will Windows Update detect this? Maybe.

With the August Microsoft SBAT update, SecureBoot will fail to boot any EFI module that specifies anything less than shim,4

What does the Ubuntu 24.04 ISO specify?
shim,2

This is why the Ubuntu 24.04 (and others) ISO won't boot on a SecureBoot system that has the August SBAT updates that Microsoft pushed out.

Aside from those unfortunate souls who have a dual-boot system that both wasn't detected by Microsoft and also is out of date enough so that its boot bits are noncompliant, who else might be affected by this?

Ventoy will fail to work on a SecureBoot-enabled Windows system with August's updates. The current Ventoy doesn't have a "shim,4" compliant EFI bootloader.

You can fix this if you don't care to wait for Ventoy to fix this.
Or do what probably a lot of people do, which is disable SecureBoot and forget to ever turn it back on again.
https://github.com/ventoy/Ventoy/issues/2692#issuecomment-2031412234

@james_inthe_box
I've been unable to reproduce the SBAT deployment, even with Linux on a separate disk. That is, in all of my testing, the August Microsoft update doesn't deploy the SBAT update if Linux is present in any way.

So I suppose that an affected party might have to volunteer some details of their config to have an idea of how it happens.

@james_inthe_box
OK, I actually did just reproduce this. I think what threw me off was that I needed to go thorough a full boot-to-windows cycle and shutdown again after installing August's update to get the SBAT update installed.

I'll likely do further testing to determine a minimal testcase, but what triggered it in this particular case is:
1) Start with a Windows 11 system
2) Add a disk and install Ubuntu 22.04 to it.
3) Set UEFI default boot option to Windows
4) Install August's updates
5) Boot into Ubuntu (e.g. via UEFI)

@james_inthe_box
Actually, it just requires booting into Windows TWICE for the SBAT to be installed on a dual-boot system. 😂

https://infosec.exchange/@wdormann/113003321097252640