With the AMD Ryzen 6000 series mobile CPUs launched earlier this year they feature Microsoft's Pluton security co-processor . While at first Linux security specialist Matthew Garrett was indicating it's not a big deal when AMD Rembrandt with Pluton was announced earlier this year, now that he got his hands on a new Lenovo Z13 AMD laptop he's singing a slightly different tune now that hardware vendors do funny things...
Matthew Garrett discovered that Linux wouldn't boot by default on the new Lenovo ThinkPad Z13 due to it by default not trusting bootloaders/drivers signed with the Microsoft 3rd Party UEFI CA Key. He wrote on his blog , " This means that given the default firmware configuration, nothing other than Windows will boot. It also means that you won't be able to boot from any third-party external peripherals that are plugged in via Thunderbolt. There's no security benefit to this. If you want security here you're paying attention to the values measured into the TPM, and thanks to Microsoft's own specification for measurements made into PCR 7, switching from booting Windows to booting something signed with the 3rd party signing key will change the measurements and invalidate any sealed secrets. It's trivial to detect this. Distrusting the 3rd party CA by default doesn't improve security, it just makes it harder for users to boot alternative operating systems. "
Lenovo Z13
The restriction to only Windows by default is rather silly but at least it sounds like it still can be disabled from within the UEFI BIOS to allowing alternative operating systems to boot. Hopefully Lenovo changes this though as indeed a rather silly move to see from them and their Linux support that had been increasing in recent times.
Finally in the next week or so I'll have my hands on a Lenovo ThinkPad X13 Gen3 AMD with Ryzen 7 PRO 6850U so I'll also be able to look more at AMD Rembrandt support in general under Linux and any Pluton/security oddities there.