Intel management engine - is macOS vulnerable? Based on, for example, the Wired reporting, this is major bad news. Intel® Management Engine Critical Firmware Update (Intel SA-00086) - www.intel.com
https://www.intel.com/content/www/us/en/support/articles/000025619/software.html

Is Apple hardware/macOS vulnerable?
First: it's not macOS itself which is vulnerable in the first place but the firmware and related hardware is affected. In a second step your system may be attacked though.

Only some of the impacted processors are installed in Macs:


6th and 7th generation Intel® Core™ Processor Family


I checked some random firmware files with the tool MEAnalyzer and found at least some containing Intel Management Engine code:

This is the MacBook Pro Retina Mid 2017:

File:     MBP143_0167_B00.fd (3/3)

Family:   CSE ME
Version:  11.6.14.1241
Release:  Production
Type:     Region, Extracted
SKU:      Slim H
Rev:      D0
SVN:      1
VCN:      173
LBG:      No
PV:       Yes
Date:     2017-03-08
FIT Ver:  11.6.14.1241
FIT SKU:  PCH-H No Emulation SKL
Size:     0x124000
Platform: SPT/KBP
Latest:   Yes


An ME entry in Family denotes Management Engine code.

In an EFIFirmware2015Update.pkg 2 of 21 firmware files contain Intel Management Engine code which may be affected by CVE-2017-5705|5708|5711|5712.

In the macOS 10.13.1 update.pkg 21 of 46 firmware files contain Intel Management Engine code which may be affected by CVE-2017-5705|5708|5711|5712.

One source and a linked source therein state that "Intel ME is baked in every CPU but according to The Register (0) the AMT part is not running on Apple hardware." AMT is also related to an older vulnerability and the Register link refers to this. Then the firmware may not be affected by CVE-2017-5711|5712 because AMT isn't present on Macs.

But some of the recent vulnerabilities don't require AMT.



In my opinion it's unclear whether Macs are affected by the Intel Q3’17 ME 11.x vulnerability - probably only Apple can tell. At least Macs are not affected by the SPS 4.0 and the TXE 3.0 bugs!