I am running Linux on a ThinkPad laptop that is affected by the Intel AMT remote exploit.

Here's the Intel advisory on the AMT remote exploit:


Here's the Lenovo page which documents which models are affected:


New firmware to fix the exploit on my ThinkPad is promised in late June, so my laptop will have the exploit for weeks no matter what I do.

Here is a discussion of the details of how it works:


From the above discussion, here's the part that I'm asking about:

AMT will also only connect itself to networks it's been explicitly told about. Where things get more confusing is that once the OS is running, responsibility for wifi is switched from the ME to the OS and it forwards packets to AMT. I haven't been able to find good documentation on whether having AMT enabled for wifi results in the OS forwarding packets to AMT on all wifi networks or only ones that are explicitly configured.

I'm running Linux (only) on my ThinkPad. I believe that my ThinkPad is safe from remote AMT exploits because Linux is unlikely to forward network packets from WiFi to the Intel AMT Management Engine. But I'd like to know for sure.

I'm going to a Linux conference this weekend (https://www.linuxfestnorthwest.org/) and I'm wondering if my laptop is at risk from the Intel AMT remote exploit. Do I need to get a USB WiFi adapter and use only that?


Under Linux, if lspci doesn't show a communication controller with "MEI" or "HECI" in the description, AMT isn't running and you're safe. If it does show an MEI controller, that still doesn't mean you're vulnerable - AMT may still not be provisioned. If you reboot you should see a brief firmware splash mentioning the ME. Hitting ctrl+p at this point should get you into a menu which should let you disable AMT.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.