@@ -984,7 +984,16 @@ Guidance: One method of minimizing resource use on invalid packets is to do the
#### 5.2.19.5 MI-LMEM: Limit memory usage
> TODO: Write mitigation requiring the interface limit memory usage triggered by user input via network or host.
The product shall limit and fairly allocate memory usage triggered by untrusted input to maintain availability of product functions and the functions of the underlying platform and other products sharing system resources.
Guidance: The product should range-check untrusted input fields that trigger memory allocations and rate-limit or drop input that would allocate enough memory to impair the functions of any part of the system.
* Reference: TR-AVAI
* Objective: Maintain service availability during denial of service attacks
* Preparation: Identify input fields from untrusted input that are used to calculate the size of memory allocations, and create a set of inputs that, if processed as fast as possible, would significantly degrade the function of the product due to overallocation of memory
* Activities: For each set of inputs, send them to the product, while simultaneously measuring the availability of the product functions and the functions of the underlying platform
* Verdict: For each set of inputs, the product functions and the platform functions remain acceptably available => PASS, otherwise FAIL
* Evidence: Set of inputs, logs of measurements, explanation of availability metrics
#### 5.2.19.6 MI-FAIR: Fair resource usage and prioritization
