Lenovo Critical Updates

Lenovo Critical Updates: a reader asked…

I keep getting a pop up notice that says I have critical Lenovo updates.  I keep ignoring b/c it doesn’t give me a link to find out what the updates are.  But it is persistent – how can I determine if I need to do this?  I have not downloaded any Lenovo updates since I got the laptop (new).

Short answer: go ahead and click Yes and then install all available Lenovo updates. All Lenovo computers come with Lenovo System Update, an app that’s provided to give you updates to the pre-installed Lenovo apps, and firmware updates for the devices built into your computer. This is similar to the Windows Update feature built into every version of the Microsoft Windows operating system. The goal is to keep your computer up-to-date, fix bugs and keep your system operating smoothly.

The popup you got has a Yes button which, if clicked, will open the Lenovo System Update program. It will start by presenting you with a list of all the updates that the software has determined that you need, segregated into critical, recommended and optional categories. Since the popup is tied to the software program, it won’t provide you with a link other than that button. Once you have the update program running, you can see all the available updates and make choices as to which you will install, they won’t install without your approval.

I should say that if your system is running normally, it’s less-than-critical that you install those updates, they are often meant to fix problems. If you’re not experiencing a problem, you can defer the update. Sometimes though, a security update is included, and those are really more critical. They usually mean that Lenovo or a software developer partner discovered a vulnerability in the software or firmware provided with your computer, and has issued a security update to patch that vulnerability. In that case you should install the update asap.

When you bought your Lenovo computer, you likely didn’t bother to read the ‘operating manual’ (if one was even provided), which probably would have told you about this feature. We humans often do this, whether we’re buying a car, a refrigerator or a computer. So naturally, when something unexpected happens, we don’t quite know what to do. In the case of your computer, here’s my general advice:

1. Trust the operating system manufacturer (Microsoft) for updates to your operating system. They provided it, and if they offer an update, it almost always is good sense to install it asap
2. Trust the manufacturer of your computer (Lenovo) for updates to your hardware, including BIOS, firmware and Lenovo-branded software. Again, this is who made your computer, and you should trust them to support their product.
3. Trust any protection software you’ve installed (such as Bitdefender, Malwarebytes, Norton Internet Security) for updates to their own software. They are providing you with valuable protection against threats to your digital life, and you paid for that protection. The same goes for any other installed software – trust that software developer to update that program.

Other than that, I’d say treat all other updates with high suspicion. And don’t trust anyone of these entities with updates for anything other than the software or hardware they made. After all, you wouldn’t trust your plumber to fix your gall bladder, and you wouldn’t trust your doctor to fix your stopped up plumbing, would you?

There is one caveat to the above, and it relates to recent threats which have been in the news. Namely, Meltdown and Spectre. These are actually vulnerabilities to your central processing unit (CPU) the big chip that’s really the brain of your computer. I previously wrote about them in my article Spectre& Meltdown Updates. The potential impact of those vulnerabilities pushed computer manufacturers to issue updates to their PC firmware in an attempt to mitigate the threats.

Lenovo issued an advisory at https://support.lenovo.com/us/en/solutions/len-18282 that talks about this and recommends updating asap. That said, my feeling is that the risk is minimal for most home users, and the fact is that a few manufacturers have already been caught out issuing bad patches that made things worse. Plus, the patches do have a negative impact on system performance (they slow your computer down a bit). Every computer user has to make their own choice about whether to install such updates or not. The problem is so widespread (virtually every computer on the planet is affected) and the supposed fix has a not-insignificant downside, so you need to find out about this threat and determine for yourself whether you should apply the fix or not.

That type of patch might be listed as a BIOS or other firmware update. If you’d like send me a screenshot of the list of updates (after hitting the Yes button on the popup). I can suggest which updates I think are related to the Spectre/Meltdown vulnerabilities, and you can decide whether to continue your process of ignoring them, or install the update.

Lastly, when Lenovo System Update warns you that there are critical updates, you should at least take the time to see what it’s about. Ignoring things may work fine, but you never know if not installing a critical update will end up turning your computer into a fancy paperweight.