** Note that this is a public ticket, please refrain from adding any sensitive data. **

=> CVE-2022-29901 : https://access.redhat.com/security/cve/CVE-2022-29901
   This CVE was addressed in the RHSA-2022:8267 - Security Advisory and was patched in package kernel-5.14.0-162.6.1.el9_1.src.rpm.

   RHSA-2022:8267 - Security Advisory : https://access.redhat.com/errata/RHSA-2022:8267

   The current 3 kernel versions are higher than this on affected machine and includes this patch already.

   [Affected_Machine]$ cat sos_commands/dnf/dnf_list_installed | grep -i kernel 
   kernel.x86_64                                    5.14.0-427.20.1.el9_4         @rhel-9-for-x86_64-baseos-rpms           
   kernel.x86_64                                    5.14.0-427.22.1.el9_4         @rhel-9-for-x86_64-baseos-rpms           
   kernel.x86_64                                    5.14.0-427.24.1.el9_4         @rhel-9-for-x86_64-baseos-rpms

=> CVE-2018-3639

   Does not affect RHEL 9 and can be verified here: https://access.redhat.com/security/cve/CVE-2018-3639

=> There are 3 possible causes why insights would flag for these CVE's.

   1. Underlying hardware, as this vulnerability affects certain Intel based CPU's.
   2. Outdated Virtualization software (hypervisor)
   3. Virtualization software (hypervisor) on the host system not propagating new CPU features correctly.

Ask From Red Hat: Insights should be altered to detect ec2 instances and no longer trigger the vulnerability since it is no longer vulnerable. This affects all insights and AWS EC2 users