What are current security risks with using a Lenovo ThinkPad T430 with no microcode updates for Qubes OS?

GenC · October 20, 2026, 5:38pm

I last followed Qubes years ago so forgive me if my knowledge is out of date.

My Qubes machine which has mostly been catching dust is the intel ME neutered + skulls T430, but I am interested in upgrading it to a newer machine now.

Last I was aware, the main risk of using that line of laptops was that a compromised VM could read the contents of another VM.

The Qubes team at the time advised not running sensitive VMs at the same time as non sensitive VMs to mitigate the risks.

I was considering the T480, but it also doesn’t get microcode updates.

I am considering dishing out cash for a certified laptop, but they’re mighty expensive.

FranklyFlawless · October 20, 2026, 8:40pm

github.com/linuxboot/heads

boards/EOL_t430-hotp-maximized/EOL_t430-hotp-maximized.config

master


      
          # WARNING: This system remains perpetually vulnerable to Spectre v2 (CVE-2017-5715). Mitigations and microcode updates previously applied are now known to be ineffective due to QSB-107 and related CVEs. If Spectre v2 is a concern in your threat model, consider migrating to a platform with ongoing microcode support. Proper OPSEC for Memory Use MUST be followed:https://www.anarsec.guide/posts/qubes/#appendix-opsec-for-memory-use
          #
          # CAVEATS: TPM_GPIO_RESET=NOT_VULNERABLE -- dedicated PLTRST# pin, not shared with GPIO
          # See doc/TPM_GPIO_Reset_Vulnerability.md for details.
          # Configuration for a T430 running Qubes 4.1 and other Linux Based OSes (through kexec)
          #
          # Includes 
          # - Deactivated+neutered ME and expanded consequent IFD BIOS regions 
          # - Forged 00:DE:AD:C0:FF:EE MAC address  (if not extracting gbe.bin from backup with blobs/xx30/extract.sh)
          #   - Note that this MAC address can be modified under build/coreboot-VER/util/bincfg/gbe-82579LM.set
          #