> I'm a layman, but spectre and meltdown seems like it can be a vehicle to exploit the intel management engine. No, or extremely unlikely at the very least. S

> I'm a layman, but spectre and meltdown seems like it can be a vehicle to exploit the intel management engine. No, or extremely unlikely at the very least. Spectre and Meltdown allow a low privilege program to read (not write, only read) normally protected system memory accessed by higher privileged software through a shared cache. In the initial attack the privileged and attacking software run on the same CPU, but there are now "Prime" versions where attacker and privileged software can run on separate CPUs as long as they're on the same coherence domain (very simplified: they share some level of cache, at least the last level). The ME on the other hand is a completely separate CPU. Although it can access system memory, likely in a coherent way, as I understand it has its own dedicated internal memories (sometimes called TCM for "tightly coupled memory" or CCM for "closely coupled meory", it's all the same: internal SRAM directly attached to a CPU core and dedicated to it). All the security context would be in these ME TCMs, so physically unaccessible from software running on the main CPU cores. It's a simple and efficient way to enforce security: true physical isolation with no sharing. So Spectre and Meltdonw may enable a low privilege application to spy on communications between privileged software on the main CPUs and the ME, but it shouldn't help attack the ME itself. Unless the Intel ME devs did something horribly wrong, like storing sensitive ME data in the main system memory. Which would be very surprising really: if you put an isolated CPU for a ME, it's really to isolate the security state.