Bug ID 760573: TPM system integrity check may return invalid status when booting into BIG-IP 14.1.0

Last Modified: Aug 06, 2019

Bug Tracker

Affected Product:  See more info
BIG-IP Install/Upgrade, TMOS(all modules)

Known Affected Versions:
14.1.0, 14.1.0.1, 14.1.0.2, 14.1.0.3, 14.1.0.4, 14.1.0.5

Fixed In:
15.0.0, 14.1.0.6

Opened: Mar 06, 2019
Severity: 2-Critical
Related AskF5 Article:
K00730586

Symptoms

The Trusted Platform Module (TPM) system integrity check may return an invalid status. As a result of this issue, you may encounter one or more of the following symptoms: -- While the system boots to BIG-IP 14.1.0, you observe an error message that appears similar to the following example: tpm-status-check[5025]: System Integrity Status: Invalid -- After rebooting the system to different volumes, you continue to observe the previous error message.

Impact

The BIG-IP system reports an invalid TPM status and TPM is non-functional.

Conditions

This issue occurs when the following condition is met: You reboot a system running either BIG-IP 13.1.x or 14.0.0 (including their point releases) to BIG-IP 14.1.0.

Workaround

To recover from this issue, you must delete the grub configuration file and reboot the system twice for an automatic repair to occur. To do so, perform the following procedure: Impact of workaround: The system will not be available while performing multiple reboots. F5 recommends that you perform this procedure during an appropriate maintenance window. 1. Log in to the command line of the affected system. 2. Mount the boot partition by typing the following command: mkdir -p /mnt/boot; mount /dev/mapper/$(ls /dev/mapper | grep boot) /mnt/boot 3. Delete the grub.multiboot.cfg file by typing the following command: rm -f /mnt/boot/grub2/grub.multiboot.cfg 4. Reboot the system by typing the following command: reboot Note: The system software fixes the grub.multiboot.cfg file automatically upon booting. 5. When the system has completed booting, log in to the command line and reboot the system again by typing the following command: reboot This final step properly boots the system with TPM enabled.

Fix Information

Rebooting a system no longer returns the TPM error.

Behavior Change