Windows Server 2022 guest and KB5012170 (Error 0x800f0922)

[Chiaki]

There's a security update for Windows Server 2022 that doesn't work easily if it runs as QEMU-KVM guest.

Related links:
- https://forum.proxmox.com/threads/kb5012170-fails-to-install-on-win11-host.113561/
- https://github.com/tianocore/edk2/discussions/3221

It's something about secure boot and the UEFI firmware used.

Does anyone have an idea how I can make this update work on TrueNAS Scale? Or is there a way to attach "pre-enrolled keys" to a disk?

 

[indivision]

There were some vulnerabilities found in a few bootloaders. So, they need to be added to the "blocked" database (DBX) in UEFI.

I'm not sure what the implications are in a VM context. A low level update is probably required if there isn't a way to manually update the UEFI databases...

[My understanding is that this specific update is isolated. So, you should be ok to get other security updates and use the OS safely while waiting for a solution for this one. Unless someone has a way to put the bad bootloaders onto your VM...]