Lenovo System Update CVE-2015-8110 Local Privilege Escalation Vulnerability

Bugtraq ID:	98037
Class:	Design Error
CVE:	CVE-2015-8110
Remote:	No
Local:	Yes
Published:	Apr 24 2017 12:00AM
Updated:	May 02 2017 12:10AM
Credit:	Sofiane Talmat of IOActive
Vulnerable:	Lenovo System Update 5.6.34 Lenovo System Update 5.6.0.28 Lenovo System Update 5.6.0.27 Lenovo System Update 3.14 Lenovo System Update 3
Not Vulnerable:	Lenovo System Update 5.7.19

Lenovo System Update CVE-2015-8110 Local Privilege Escalation Vulnerability

Lenovo System Update is prone to a local privilege-escalation vulnerability.

A local attacker can exploit this vulnerability to gain elevated privileges.

Versions prior to Lenovo System Update 5.07.0019 are vulnerable.

Lenovo System Update CVE-2015-8110 Local Privilege Escalation Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Lenovo System Update CVE-2015-8110 Local Privilege Escalation Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Lenovo System Update CVE-2015-8110 Local Privilege Escalation Vulnerability

References:

• LEN-2015-011: Lenovo System Update Privilege Escalation (Lenovo)
  
• Lenovo Homepage (IBM)
  
• TVSUkernel Escalation of Privileges (ioactive.com)