[Bug 2144897] Re: GRUB chainloading Windows breaks BitLocker TPM PCR measurements

[graingert]

I've made a fix available as a debian package and submitted it as an RFP
to debian at https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1131283

** Bug watch added: Debian Bug tracker #1131283
   https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1131283

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to grub2 in Ubuntu.
https://bugs.launchpad.net/bugs/2144897

Title:
  GRUB chainloading Windows breaks BitLocker TPM PCR measurements

Status in grub2 package in Ubuntu:
  New

Bug description:
   When GRUB chainloads \EFI\Microsoft\Boot\bootmgfw.efi to boot Windows, the
   TPM PCR measurements are altered because GRUB is in the boot chain. This causes
   BitLocker to prompt for the recovery key on every boot via GRUB.
   .
   This affects all Ubuntu dual-boot setups with Windows + BitLocker on UEFI systems.
   .
   Workaround: I've developed a workaround that boots a minimal Linux kernel/initramfs
   which sets the UEFI BootNext variable via efibootmgr and immediately reboots. The
   firmware then boots Windows natively with correct TPM state. BitLocker is happy.
   The premount script runs before the LUKS prompt, so you never have to enter your
   Linux disk encryption password just to boot Windows.
   .
   See: https://gist.github.com/graingert/38d834a24a760d664b3f903ed48d6dca
   .
   Proposed solution: GRUB (or os-prober / 30_os-prober) should support setting
   EFI BootNext and triggering a reboot instead of chainloading. This would make
   dual-booting with BitLocker work out of the box without breaking TPM measurements.

  ProblemType: Bug
  DistroRelease: Ubuntu 24.04
  Package: grub2-common 2.12-1ubuntu7.3
  ProcVersionSignature: Ubuntu 6.17.0-19.19~24.04.2-generic 6.17.13
  Uname: Linux 6.17.0-19-generic x86_64
  ApportVersion: 2.28.1-0ubuntu3.8
  Architecture: amd64
  CasperMD5CheckResult: pass
  CurrentDesktop: ubuntu:GNOME
  Date: Thu Mar 19 12:03:36 2026
  InstallationDate: Installed on 2022-07-23 (1335 days ago)
  InstallationMedia: Ubuntu 22.04 LTS "Jammy Jellyfish" - Release amd64 (20220419)
  SourcePackage: grub2
  Title: GRUB chainloading Windows breaks BitLocker TPM PCR measurements
  UpgradeStatus: Upgraded to noble on 2024-09-12 (553 days ago)

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/2144897/+subscriptions