I've got a ThinkPad X220 and I've been a bit lax about patching the UEFI/BIOS. But recently this SMM "Incursion" Attack has been getting a bit of publicity and it's spurred me to try to patch it. It's worth noting that this bug is not specific to Lenovo, but something that affects most vendors of Intel based hardware. For those interested some of the best coverage I've found was from a recent risky business podcast¹.

Unfortunately Lenovo don't provide a way to upgrade the BIOS from Linux. While the ThinkPad X220 is officially supported with Linux (RedHat and Fedora) the only BIOS update utility they provide is for Windows.

I went on to the Lenovo support site and for the BIOS update, under Operating system I picked "Not Applicable" a few patches BIOS and Firmware patches came up but all of them were .exe files.

After a long time of searching I found that they do provide a .iso file of a bootable CD to patch your BIOS but you have to pick Windows as the operating system to find it. I have no idea why they think that .exe files are "Not Applicable" but an iso is a Windows specific option but maybe they didn't put much thought into it.

Now that I had an iso I was half way there, but the ThinkPad X series don't have an optical drive and simply dd'ing the image onto a flash drive didn't work.

I found some instructions on ThinkWiki with a link to a perl script that could create a bootable image.

I copied the image onto a flash drive but when I tried to boot it failed, after a bit of experimentation I found that the instructions on ThinkWiki were not quite right, they recommended setting the boot to UEFI only but I found that I needed to use Legacy BIOS to boot the flash drive.

After that I was able to boot the drive and update my BIOS.

Final steps

So in summary the steps that finally worked were:

1. Download the iso file.
2. Convert the iso file to a bootable image.
   1. wget https://userpages.uni-koblenz.de/~krienke/ftp/noarch/geteltorito/geteltorito.pl
   2. perl geteltorito.pl -o ThinkPad-x220-bios-update.img 8duj27us.iso
3. Copy the image onto a flash drive
   1. Check the name of your flash drive first! dd if=ThinkPad-x220-bios-update.img of=/dev/sdb
4. Set boot to "Both" Legacy and UEFI
   1. Reboot, pressing F1 while booting to enter setup
   2. Go to Setup > UEFI/Legacy Boot > Both
   3. F10 to save and exit
5. Boot the flash drive
   1. Press F12 while booting to and select your flash drive.

Follow the prompts to upgrade your UEFI/BIOS and your done.