Multiple high privilege executables will be spawned by the service executable upon update. The System Update applications run as a low privilege executable(user interface) and a service executable running as “NT Authority/SYSTEM”.

Lenovo will disclose the vulnerability publicly September 8 2020.

Lenovo Product Security Incident Response Team releases version of System Update which patches the vulnerability. Lenovo Product Security Incident Response Team confirms the vulnerability, given internal vulnerability number LEN-41150. Lenovo Product Security Incident Response Team informs that they are investigating the issue. – Lenovo Product Security Incident Response Team e-mailed with detailed description. Like in my previously disclosed vulnerabilities for Intel Driver & Support Assistant and Splashtop Streamer, the process of updating software and firmware can, if not implemented securely, leave a system vulnerable for privilege escalation.

The application often comes preloaded on Lenovo systems. System Update is an application for keeping drivers, firmwares and software packages up-to-date on Lenovo workstations or laptops.

Lenovo system update