7 Replies Latest reply on Dec 1, 2017 10:07 AM by N.Scott.Pearson

    Where do I find Intel® ME to address INTEL-SA-00086?


      I have a home-built Core i7-6700 rig and I am looking for a Windows 10 64 bit Management Engine update to close the vulnerabilities listed in INTEL-SA-00086 but I can only find one at Lenovo's site for Thinkpads.

      (Intel Management Engine 11.8 Firmware for Windows 10 (64-bit), 8.1 (64-bit), 7 (32-bit, 64-bit) - ThinkPad)


      Where do I find an update that isn't associated with a vendor?


      Processor Name: Intel(R) Core(TM) i7-6700 CPU @ 3.40GHz


      Intel(R) ME Information

      Engine: Intel(R) Management Engine


      SVN: 1

        • 1. Re: Where do I find Intel® ME to address INTEL-SA-00086?
          Intel Corporation
          This message was posted on behalf of Intel Corporation

          : Thank you very much for contacting the Intel® Processors communities. We will do our best to try to provide the information you are looking for.

          In regard to your inquiry, in order to get the proper Management Engine update for your system, the best thing to do will be to get in contact with Lenovo directly, they should be able to further assist you with this subject:

          Any further questions, please let me know.

          Alberto R

          • 2. Re: Where do I find Intel® ME to address INTEL-SA-00086?



            Per the advisory: "If the INTEL-SA-00086 Detection Tool reported your system being vulnerable, please check with your system (or board) manufacturer for updated firmware."

            The update in blue is mine; it points out that, for those folks who built their own system, they need to get the update from their board's manufacturer.



            1 of 1 people found this helpful
            • 3. Re: Where do I find Intel® ME to address INTEL-SA-00086?

              Alberto, I would have thought that to work for Intel you would at least need to know how to read.


              The original poster said that he has a own built PC however the only links he could find to resolve this issue we pointing to OEMs. There is no link for us people who built our own computers. I am infuriated with Intels response to this security issue. I too have a processor that is vulnerable, the detection tool gives a link that takes you back to the page where you download the tool from leaving you in an infinite loop of useless information.


              What on earth would be the point in the original poster getting in touch with Lenovo, to ask them for advice on a product that is not theirs.


              Please can you read peoples posts before you reply, and hopefully you can answer this question we have with relevant information that will allow us to resolve a major security issue. We, your customers who spend a considerable amount of money buying your products, have to wait so long for answers that we would like the right information given the first time around.

              • 4. Re: Where do I find Intel® ME to address INTEL-SA-00086?

                Hi Paul;


                I do not understand why, but, the firmware updates are delivered via a system's BIOS.  This being the case and, since you built the system, you are dependent on your mainboard manufacturer.  See Asrock's site, for example.  Tom's Hardware has a good write-up here - note the last paragraph.


                In other words, your vendor is your mainboard manufacturer.




                1 of 1 people found this helpful
                • 5. Re: Where do I find Intel® ME to address INTEL-SA-00086?

                  It is quite simple. The board manufacturers have control over the content and format of their firmware hub(s). They consider this to be a point of differentiation and thus want to control it. As a result, Intel cannot deliver a generic package that installs the update; the board manufacturer must do so (only they know where to store it in their firmware hub(s)).


                  Bottom line, you must get the update from your board manufacturer. If your board manufacturer is slow delivering the update or refusing to deliver one at all, let them - and the world - know that this is unacceptable.



                  1 of 1 people found this helpful
                  • 6. Re: Where do I find Intel® ME to address INTEL-SA-00086?

                    N.Scott I want to thank you for this clarification. It truly is shocking that the motherboard manufacturers have to be the ones to push a bios update, it's also shocking the amount of time they are taking for this. Personally I use a Asus board where they have only announced an upcoming fix for their workstation (WS) boards, with no fix in sight. I would have thought that surely due to the fact this firmware is on the CPU itself, you would be installing the firmware there? My question to this is, this BIOS update motherboard manufactures are giving out won't fix the CPU will it? It will only change the software/firmware of the motherboard? You take your CPU out and put it into another motherboard, the issue will go with the CPU?


                    Secondly it would have been nice for Intel to clarify this by reading the original post properly, to give this correct information the first time around.

                    • 7. Re: Where do I find Intel® ME to address INTEL-SA-00086?

                      Oh, no, you misunderstand. The Intel Management Engine (ME) is just one of the set of special microcontrollers that reside within the chipset (PCH component), not the processor. Despite how much it does for the security and proper operation of the processor, it is still a board-level entity.




                      P.S. Intel will eventually move the ME inside the processor. I could see the ME's firmware then being delivered separately and perhaps (also) be stored within the processor. For now though, while the ME is still in the chipset, it's firmware will continue to reside (somewhere) within the board's Firmware Hub.

                      2 of 2 people found this helpful