Intel BootGuard has kept most Skylake/Kaby-Lake/Coffee-Lake laptops locked away from opensource coreboot BIOS – until now.
At the end of 2024, Ubuntu developer Mate Kukri introduced deguard, a small utility that leverages CVE-2017-5705 inside ME 11.x to disable BootGuard fuses in SRAM. The result: previously “un-coreboot-able” machines – e.g. Lenovo T480/T480s and Dell OptiPlex 3050 – can boot unsigned firmware again. It has been presented and discussed at the Dasharo Developers vPub 0xE, you can watch the presentation and look through the slides below.
What deguard does
- “Downgrades ME via SPI flash overwrite”
- “Patches BootGuard fuses on-the-fly”
- “Lets you sign nothing at all – coreboot just runs”
Why it matters
- “Opens the door for community coreboot BIOS ports on 8th-gen Intel laptops”
- “Helps the opensource BIOS computer vendors like NovaCustom to deliver the newer hardware”
- “Great teaching example of how not to design a root-of-trust”
10-min talk + live demo video / slides (free) from our previous vPub online party (btw a new one will take place on 12th June) :
Slides direct PDF: https://dl.3mdeb.com/dasharo/dug/9/7.introduction-to-deguard.pdf
Happy to answer questions, share flashing notes, or compare against other BootGuard work-arounds