This is how I updated my Intel ME firmware on my Lenovo X1 Carbon Gen 4 (reports say this also has worked for Gen5 machines). These instructions are pretty strongly inspired by https://news.ycombinator.com/item?id=15744152

Why? Intel security advisory and CVE-2017-5705, CVE-2017-5708, CVE-2017-5711, and CVE-2017-5712 should be reason enough.

You will need:

• To download about 3.5GB of stuff
• A USB key
• Linux installed
• WINE or a Windows box to run two executables (because self extracting archives are a thing on Windows apparently)
• A bit of technical know-how. A shell prompt shouldn’t scare you too hard.

Steps:

1. Go to https://www.microsoft.com/en-au/software-download/windows10ISO and download the 32-bit ISO.
2. Mount the ISO as a loopback device (e.g. by right clicking and choosing to mount, or by doing ‘sudo mount -o loop,ro file.iso /mnt’
3. Go to Lenovo web site for Drivers & Software for your laptop, under Chipset, there’s ME Firmware and Software downloads You will need both. It looks like this:
   
4. Run both exe files with WINE or on a windows box to extract the archives, you do not need to run the installers at the end.
5. you now need to extract the management engine drivers. You can do this in  ~/.wine/drive_c/DRIVERS/WIN/AMT, with “cabextract SetupME.exe” or (as suggested in the comments) you can use the innoextract utility (from linux) to extract them (a quick check shows this to work)
6. Save off HECI_REL folder, it’s the only extracted thing you’ll need.
7. Go and install https://wimlib.net/ – we’re going to use it to create the boot disk. (it may be packaged for your distro).
   If you don’t have the path /usr/lib/syslinux/modules/bios on your system but you do have /usr/share/syslinux/modules/bios – you will need to change a bit of the file programs/mkwinpeimg.in to point to the /usr/share locations rather than /usr/lib before you install wimlib. This probably isn’t needed if you’re installing from packages, but may be requried if you’re on, say, Fedora.
8. Copy ~/.wine/drive_c/DRIVERS to a new folder, e.g. “winpe_overlay” (or copy from the Windows box you extracted things on)
9. Use mkwinpeimg to create the boot disk, pointing it to the mounted Windows 10 installer and the “winpe_overlay”:

   mkwinpeimg -W /path/to/mounted/windows10-32bit-installer/ -O winpe_overlay disk.img

10. Use ‘dd’ to write it to your USB key
11. Reboot, go into BIOS and turn Secure Boot OFF, Legacy BIOS ON, and AMT ON.
12. Boot off the USB disk you created.
13. In the command prompt of the booted WinPE environment, run the following to start the update:

    cd \
    cd HECI_REL\win10
    drvload heci.inf
    cd \
    cd win\me
    MEUpdate.cmd

    It should look something like this:

    

14. Reboot, go back into BIOS and change your settings back to how you started.