chore: bump kernel to 5.15.23

[frezbo]

Bump kernel to 5.15.23

Fixes CVE-2022-0435, as of
#394 Talos is not affected

Signed-off-by: Noel Georgi git@frezbo.dev

[smira]

I guess we need to backport kernel bump to release-0.9 as well. Probably not the #394 to avoid big (breaking?) changes

[frezbo]

I'm not sure, we probably don't have anything using TIPC in userspace, but safer to update

[frezbo]

I guess we need to backport kernel bump to release-0.9 as well. Probably not the #394 to avoid big (breaking?) changes

https://www.openwall.com/lists/oss-security/2022/02/10/1 since we don't load it and have KASLR enabled maybe we can skip backporting

[smira]

It's also worth noting that the current CONFIG_FORTIFY_SRC=y is a hard
mitigation to leveraging CVE-2022-0435 for control-flow hijacking, as it
does a bounds check on the size of the offending memcpy and causes a
kernel panic.

I think loading is not relevant, as we have built into the kernel, but on other hand probably yes, it's only panic potentially. But at the same time it might make to bump to address issues.

[smira]

I will create backport for 5.15.23 to release-0.9

[smira]

/m