Skip to main content

Lenovo's New Ryzen Laptops Default to Windows-Only Boot

Lenovo Thinkpad Z13
(Image credit: Lenovo)

According to a new report by Phoronix, some of Lenovo's new AMD Ryzen 6000 laptops paired with Microsoft's Pluton security chip will not boot any other operating system besides Windows by default. Linux security expert Matthew Garrett initially discovered the issue in his blog post when he tried booting Linux from a USB thumb drive on his Z13 ThinkPad.

The main issue with Lenovo's security measure is that it provides no additional security benefits by locking out other operating systems. In addition, these new laptops, by default, do not trust bootloaders signed with Microsoft 3rd party UEFI CA keys to maintain higher security, which Garrett is useless.

Garrett points out that the primary security measure that is beneficial in Lenovo's laptops is related to the TPM and the security data it holds. When a new non-Windows OS is loaded onto the system which supports Secure Boot and TPM, keys from the previous OS get wiped away due to the 3rd party CA, making them useless for attackers to grab off the system. Because of this, there is no reason to lock out non-Windows operating systems since any critical data is wiped and replaced.

Thankfully this issue won't be a serious problem for most users since most of the world does run Windows operating systems. But this could be a very problematic issue for the few diehards who use Linux. There's a chance this operating system lock can be changed within the BIOS, but this has not been confirmed.

To clarify, this issue is specific to Lenovo and does not incorporate a flaw in Microsoft's new Pluton security processor. Pluton is a new co-processor offering additional security to a system's TPM or Trusted Platform Module by emulating a TPM module virtually on the CPU. Without Pluton, attackers can physically hijack the TPM's communication bus to grab sensitive keys and information.

Aaron Klotz
Aaron Klotz

Aaron Klotz is a freelance writer for Tom’s Hardware US, covering news topics related to computer hardware such as CPUs, and graphics cards.

  • hotaru251
    wait wasnt lenovo also the brand that had the default popup efefctively make your cpu lock itself to that 1 machine?

    At this point I wouldnt risk one of their devices for shady tactics.
    Reply
  • rluker5
    Yes, but just AMD cpus as they are the only ones with the fuses to be blown to do that.
    But then again I haven't heard of anybody but Lenovo doing either of these so maybe it will stay isolated to them. And xbox.

    But chips with Pluton are new so more snooping, limitations and vulnerabilities might come out. But haven't yet, to be fair.
    Reply
  • edzieba
    Since part of the Windows Platform Requirements is the implementation of a default "Standard" Secure Boot mode and a user-selectable "Custom" Secure Boot mode (where other kays can be added), with those lines in the standards doc prefixed with an allcaps MUST, this seems like a Lenovo screwup rather than something required by Microsoft (as it goes directly against the requirements from Microsoft).
    rluker5 said:
    But then again I haven't heard of anybody but Lenovo doing either of these so maybe it will stay isolated to them. And xbox.
    Dell have also been doing it with EPYC servers.
    Reply
  • ed-pgt
    We just recieved a few of these at work. I can confirm you can disable the chip in the bios. I'm currently dual booting windows and xubuntu.

    Reply
  • Alvar "Miles" Udell
    If it can be disabled in BIOS, and that option disabled and protected by, say, IT admin, then this appears to be another layer of security to prevent someone from obtaining the laptop and booting to Linux via USB to circumvent security and, say, quickly mirror the drive before the owner notices. Wouldn't prevent against stronger attacks, but could help cut down on more quick, clandestine attacks.
    Reply
  • edzieba
    Alvar Miles Udell said:
    If it can be disabled in BIOS, and that option disabled and protected by, say, IT admin, then this appears to be another layer of security to prevent someone from obtaining the laptop and booting to Linux via USB to circumvent security and, say, quickly mirror the drive before the owner notices. Wouldn't prevent against stronger attacks, but could help cut down on more quick, clandestine attacks.
    If the drive is encrypted, booting to another OS would not allow reading it. If its unencrypted, you can pop the drive and read it in another chassis.
    Reply
  • Alvar "Miles" Udell
    edzieba said:
    If the drive is encrypted, booting to another OS would not allow reading it. If its unencrypted, you can pop the drive and read it in another chassis.

    Which is why I said "Wouldn't prevent against stronger attacks, but could help cut down on more quick, clandestine attacks."
    Reply
  • edzieba
    Alvar Miles Udell said:
    Which is why I said "Wouldn't prevent against stronger attacks, but could help cut down on more quick, clandestine attacks."
    It's more like worrying about whether your window is armoured enough when your front door is left open and unlocked. If your drive is unencrypted, then Secure Boot is clearly WAY down the priority list. Unencrypted laptop drives are "everyone's password is set to 'password" levels of basic security fail.

    As for quick attacks: I'm pretty confident that with the frankly awful UEFI interfaces most OEMs use (Dell being particularly egregious in breaking keyboard navigation in the most recent version), I could remove the drive from the chassis with an unpowered screwdriver faster than I could disable Secure Boot and boot an alternate OS. And as for 'clandestine': popping a drive into a write-blocker and imaging it (with a shim used to defeat the chassis intrusion switch) is far less noticeable than changing BIOS settings - and thus clearing the keystore - and fiddling with UEFI settings.
    Reply