Intel BootGuard has kept most Skylake/Kaby-Lake/Coffee-Lake laptops locked away from coreboot – until now.
At the end of 2024, Ubuntu developer Mate Kukri introduced **deguard**, a small utility that leverages **CVE-2017-5705** inside ME 11.x to *disable* BootGuard fuses in SRAM. The result: previously “un-coreboot-able” machines – e.g. **Lenovo T480/T480s** and **Dell OptiPlex 3050** – can boot unsigned firmware again. It has been presented and discussed at the **Dasharo Developers vPub 0xE**,