12mo ago

How to extract firmware of my Lenovo T480?

Binarly PKfail detector

I want to check if my Lenovo T480 is afftected by the recent PKFail, but have no idea how to extract the bios firmware for validation. Can someone detail the steps? Thanks.

7 comments

https://arstechnica.com/security/2024/07/secure-boot-is-completely-compromised-on-200-models-from-5-big-device-makers/
Bottom of that article, there are commands to run from windows and Linux to detect it. Probably easier than messing with the firmware.
- Thanks for the hint. I followed and checked: safe
  
  $ efi-readvar -v PK Variable PK, length 983 PK: List 0, type X509 Signature 0, size 955, owner 3cc24e96-22c7-41d8-8863-8e39dcxxxxxx Subject: C=JP, ST=Kanagawa, L=Yokohama, O=Lenovo Ltd., CN=Lenovo Ltd. PK CA 2012 Issuer: C=JP, ST=Kanagawa, L=Yokohama, O=Lenovo Ltd., CN=Lenovo Ltd. PK CA 2012
I can't say for certain, but I think you just have to grab the last firmware binary released for your T480 from the Lenovo website and run it through the online validator: https://pk.fail/
- Tried. They only release it for Windows, or a bootable ISO, which I can't see what files are in there. I also tried getting the firmware from LVFS but I'm not sure if I done it right as non of them start with "EFI " header (which I assume that's the file I should be looking at).
  
  An ISO is just another archive format, similar to zip, tarballs, and rar files. Most modern archive tools can open and/or extract its contents like any other archive.
  Edit:
  It looks like Lenovo releases their ISOs formatted as a CD image. See: https://workaround.org/article/updating-the-bios-on-lenovo-laptops-from-linux-using-a-usb-flash-stick/

7 comments