Intel Management Engine (ME) imposes a security risk (see here for example). As I understand ME is a part of Intel vPro. Does having an Intel CPU without vPro support mean ME is not fully functional and hence less vulnerable? I've seen multiple (non-authoritative, not linking here) claims on the Internet that all the recent Intel CPU have ME enabled. I'm confused what having no vPro support actually means regarding ME and related security issues.
Intel vPro is not a single thing, but is actually a group of several Intel technologies working together to provide a certain set of services. The Intel vPro reference guide lists those technologies (emphasize is mine):
Intel vPro technology is a collection of platform capabilities that support enhanced manageability, security, virtualization, and power efficiency. The key platform capabilities include the following Intel technologies:
- Intel Turbo Boost Technology for increased performance and power efficiency
- Intel Virtualization Technology (Intel VT) for Dynamic Virtual Client support and other operating system or application streaming techniques using virtualization
- Intel Hyper-Threading Technology (Intel HT) for higher performance
- Intel Active Management Technology (Intel AMT) for greater manageability
- Intel Anti -Theft Technology (Intel AT) for greater security
- Intel Trusted Execution Technology (Intel TXT) for greater security
- Intel Identity Protection Technology (Intel IPT) for enhanced web security
Among these various technologies is the Intel Active Management Technology, which allows system administrator to remotely manage companies computers independently of their location and their state: even computers turned off or computer where the operating system fails to boot can still be managed using this technology.
What happened is that a security researcher found an vulnerability allowing a remote, unprivileged user to take control of this management feature.
As stated in Intel's Security Advisory (emphasize is mine):
There is an escalation of privilege vulnerability in Intel® Active Management Technology (AMT), Intel® Standard Manageability (ISM), and Intel® Small Business Technology versions firmware versions 6.x, 7.x, 8.x 9.x, 10.x, 11.0, 11.5, and 11.6 that can allow an unprivileged attacker to gain control of the manageability features provided by these products. This vulnerability does not exist on Intel-based consumer PCs with consumer firmware, Intel servers utilizing Intel® Server Platform Services (Intel® SPS), or Intel® Xeon® Processor E3 and Intel® Xeon® Processor E5 workstations utilizing Intel® SPS firmware.
AMT is part of the Intel's vPro offering and is not available on non-vPro devices like "consumer PCs with consumer firmware" and "Intel servers utilizing Intel® Server Platform Services (Intel® SPS)".
Intel CPUs without vPro support therefore do not seem vulnerable to this attack as they lack the vulnerable firmware.