PT-2017-7321 · Lenovo · Lenovo System Update

Published 2017-04-24 · Updated 2017-04-28 · CVE-2015-8110

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Lenovo System Update versions prior to 5.07.0019

Description A local privilege escalation issue exists, allowing local users to gain privileges. This can be achieved by navigating to specific links, such as "Click here to learn more" or "View privacy policy", within the Tvsukernel.exe GUI application when using a temporary administrator account.

Recommendations For versions prior to 5.07.0019, update to version 5.07.0019 or later to resolve the issue. As a temporary workaround, consider restricting access to the Tvsukernel.exe GUI application to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2015-8110

Affected Products

Lenovo System Update

References · 4

• 🔥 https://ioactive.com/pdfs/IOActive_Advisory_Lenovo_TVSUkernel-Escalation-Privileges.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-8110 · Security Note
• https://support.lenovo.com/us/en/product_security/lsu_privilege · Vendor Advisory
• http://securityfocus.com/bid/98037 · Note