Based on, for example, the Wired reporting, this is major bad news. Intel® Management Engine Critical Firmware Update (Intel SA-00086) - www.intel.com https://www.intel.com/content/www/us/en/support/articles/000025619/software.html

Is Apple hardware/macOS vulnerable?

  • 3
    To avoid further confusion: There was another bug related to IME back in May, INTEL-SA-00075, which didn't appear to affect Apple products. Several of the responses that have appeared to this question have mistakenly referenced information about the earlier vulnerability. However, this question's asking about a more recently reported vulnerability, INTEL-SA-00086. – Nat Nov 29 '17 at 4:43

First: it's not macOS itself which is vulnerable in the first place but the firmware and related hardware is affected. In a second step your system may be attacked though.

Only some of the impacted processors are installed in Macs:

  • 6th and 7th generation Intel® Core™ Processor Family

I checked some random firmware files with the tool MEAnalyzer and found at least some containing Intel Management Engine code:

This is the MacBook Pro Retina Mid 2017:

File:     MBP143_0167_B00.fd (3/3)

Family:   CSE ME
Version:  11.6.14.1241
Release:  Production
Type:     Region, Extracted
SKU:      Slim H
Rev:      D0
SVN:      1
VCN:      173
LBG:      No
PV:       Yes
Date:     2017-03-08
FIT Ver:  11.6.14.1241
FIT SKU:  PCH-H No Emulation SKL
Size:     0x124000
Platform: SPT/KBP
Latest:   Yes

An ME entry in Family denotes Management Engine code.

In an EFIFirmware2015Update.pkg 2 of 21 firmware files contain Intel Management Engine code which may be affected by CVE-2017-5705|5708|5711|5712.

In the macOS 10.13.1 update.pkg 21 of 46 firmware files contain Intel Management Engine code which may be affected by CVE-2017-5705|5708|5711|5712.

One source and a linked source therein state that "Intel ME is baked in every CPU but according to The Register (0) the AMT part is not running on Apple hardware." AMT is also related to an older vulnerability and the Register link refers to this. Then the firmware may not be affected by CVE-2017-5711|5712 because AMT isn't present on Macs.

But some of the recent vulnerabilities don't require AMT.


In my opinion it's unclear whether Macs are affected by the Intel Q3’17 ME 11.x vulnerability - probably only Apple can tell. At least Macs are not affected by the SPS 4.0 and the TXE 3.0 bugs!

  • @Nat You are right: obviously I missed the first half sentence... – klanomath Nov 27 '17 at 11:00
  • Do read @vykor's answer and the links it point to. – Gilby Nov 28 '17 at 23:19
  • 2
    @Gilby As mentioned in my post two of the vulnerabilities don't rely on AMT: CVE-2017-5705|5708! – klanomath Nov 28 '17 at 23:22

Screen shot if the intel detection tool run in boot camp on a Q32017 MacBook Pro Intel detection tool: https://www.intel.com/content/www/us/en/support/articles/000025619/software.html

Bad news guys

Screen shot if the intel detection tool run in boot camp on a Q32017 MacBook Pro

  • This newest answer seems rather compelling -- relatively simple and straightforward evidence that the answer is yes. – Matthew Elvey Dec 18 '17 at 3:34
  • I really wish a kindred spirit would do this for the the 2015 Macbook Pro. – Nostalg.io Jan 4 at 7:36

I can confirm, with info directly from my local Apple Store, that Intel Macs do indeed ship with Intel ME hardware, and that Apple does not modify any Intel hardware. Though at this point I can't confirm or deny that macs run Intel firmware or not for ME, the other answers to this question seem to suggest that they do run Intel firmware.

I dare say that Apple machines are all vulnerable, and are affected in a much more dramatic way than other machines that already have patches available for download at the time of this post. The reason is that many many macs seem have outdated Intel firmware, assuming they have it and the python scripts other people are using to check the version of their firmware's aren't erroneous, or alluding to custom Apple written firmware for the ME hardware that is present in the machine. Klanomath, your machine seems to be fairly screwed with an old as 9.5.3 version of ME firmware. That 11.6.5 firmware on another machine is also clearly vulnurable as well, as per the intel audit, as seen here:

https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00086&languageid=en-fr

You need to update to 11.8.0 or up. In particular, this hack is so troubling because it "allow[s] [an] attacker with local access to the system to execute arbitrary code. Multiple privilege escalations ... allow unauthorized process to access privileged content via unspecified vector. ... allow attacker with local access to the system to execute arbitrary code with AMT execution privilege. ... allows attacker with remote Admin access to the system to execute arbitrary code with AMT execution privilege."

"Execute arbitrary code, privilege escalation, remote access to system and execute arbitrary code." This is insane! Especially because Intel ME allows for remote access even when a system is powered off, though that might only be with AMT software, which apparently Apple does not have.

  • The firmware (IM144_0179_B12_LOCKED.scap) mentioned in the comment to jksoegaard's answer is not my machine's firmware but the one of an iMac "Core i5" 1.4 21.5-Inch (Mid-2014) I extracted from Mac EFI Security Update 2015-002 ;-). I think the firmware of my iMac is older. – klanomath Nov 27 '17 at 3:54

Excerpt from INTEL-SA-00086: "The attacker gains physical access by manually updating the platform with a malicious firmware image through flash programmer physically connected to the platform’s flash memory."

Unless your Apple product is operating in a public lab where nefarious people may gain physical access to the device, you probably don't have much to worry about. The security advisory doesn't mention it, but I read elsewhere on a PC/Windows forum the attack comes to Flash Descriptor firmware via a USB port (flash drive). There is already USB-flash technology to hijack an Apple computer using a limited Linux kernel on a flash drive. For most people this won't be much of an issue.

  • 2
    While true for this, there's some other ME stuff that potentially could work remotely. Note that the firmware updates on macOS don't require physical access since it's all initialized from and OS level; if a malicious update could be injected (currently not possible AFAIK, but plausible that some issue in the future lies along these lines) then–if Macs used a version of the ME that was vulnerable, then this would be very problematic. – JMY1000 Jan 4 at 3:27

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.