CWE-1229 is a class level weakness. The product manages resources, or behaves, in a way that indirectly creates a new and distinct resource that attackers can use in violation of the intended policy.
It is abstract by design, and it matters most to architects of systems with complex behavior.
How it happens
A product is expected to do what the developer intended and nothing else. Resource allocation and management are supposed to happen explicitly in code. In complex systems, though, behavior can produce new kinds of resources that were never part of the original design.
MITRE offers two illustrations. A covert channel is a resource nobody intended to build, yet useful to an attacker. "Parasitic computing," while not necessarily malicious, tricks a product into performing unintended computations on behalf of another party.
You cannot write a line of code that says "create an emergent resource." It is a property of how the pieces interact, which is why it is hard to see in review.
What an attacker gains
The record lists an impact that varies by context. The gain depends on what the new resource exposes: a channel for moving information out, or computation that someone else gets for free.
How to find it
The record has no detection methods. Threat modeling is the natural fit. For each shared resource, such as timing, storage, caches or capacity, ask whether one party can influence it and another can observe it.
How to fix it
The record has no formal mitigations. Reasonable steps follow from the description: reduce shared state between parties of different trust, limit what one party can observe of another's activity, and document the intended resources so unintended ones stand out.
Quick check
What is an example of an emergent resource?
A covert channel, which no developer intended but which an attacker can use to move information in violation of policy.
