Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP_SYS_TIME and cross-tenant node wall-clock corruption

Fission v1.24.0 added PodSpec safety validation for tenant-facing Environment and Function CRDs ValidatePodSpecSafety / ValidateContainerSafety admission webhook + sanitizeContainerSecurityContext executor merge layer, but the capability check was implemented as a fixed denylist of six Linux...

Linux kernel 缓冲区错误漏洞

The Linux kernel is an open source Unix-like operating system macro kernel for efficient resource management. A security vulnerability exists in the Linux Kernel where constants used to populate pointers in structures passed to bpfsysbpf are unverified and can point anywhere, and an attacker with...