Lenovo has patched critical flaws in its computers that allow an attacker to compromise the System Update service.