Some Lenovo laptops powered by AMD Rembrandt chips and Microsoft’s Pluton security co-processor are being restricted to Windows operating systems, reports have claimed.
The quirk was initially found by Linux security expert Matthew Garrett, who found he had difficulties getting Linux to boot from a USB drive on a Lenovo Z13 ThinkPad laptop workstation.
Those affected are running the AMD Ryzen 6000 chip, and have been found only to be allowing versions of Windows OS to boot by default.
Linux OS for Lenovo laptops
It seems that the affected Lenovo laptops do not trust bootloaders that use Microsoft 3rd party UEFI CA keys. When an operating system other than Windows is loaded onto the laptops which support Secure Boot and TPM, the previous OS’s keys are wiped.
Garrett explained on his blog (opens in new tab) that it “means that you won’t be able to boot from any third-party external peripherals that are plugged in via Thunderbolt.”
He continues: “There’s no security benefit to this. If you want security here you’re paying attention to the values measured into the TPM, and thanks to Microsoft’s own specification for measurements made into PCR 7, switching from booting Windows to booting something signed with the 3rd party signing key will change the measurements and invalidate any sealed secrets. It’s trivial to detect this. Distrusting the 3rd party CA by default doesn’t improve security, it just makes it harder for users to boot alternative operating systems.”
For now, it sounds like it may be possible to boot Linux onto affected AMD-powered Lenovo laptops by disabling the restriction from within the UEFI BIOS, but given the company’s recent improvements in support for the Linux OS recently, the entire move seems somewhat counterproductive if not confusing.
This is unlikely to cause an issue for most users, who are happy with the default Windows OS, however this may put pro users off an entire chunk of the Lenovo range. That said, Tom’s Hardware (opens in new tab) emphasises that this hurdle does not correspond directly to all Lenovo or Microsoft Pluton-powered laptops, which is great news for Linux lovers.
