CWE-514 defines a covert channel as a path that can be used to transfer information in a way not intended by the system's designers. Typically the system has not authorized the transmission and does not know it is happening.
How it happens
A covert channel uses something that was built for another purpose to carry data. Two parts of a system that should not talk end up talking through a shared resource. CWE-514 is the general class. Its child entries include storage channels, which MITRE covers under CWE-515.
What an attacker gains
MITRE lists reading application data and bypassing a protection mechanism, affecting confidentiality and access control. Data can leave, or cross a boundary, without passing any check.
How to find it
The method the record lists is architecture or design review, using inspection to look for resources that two parties can both observe. It is cost effective for partial coverage rather than complete.
How to fix it
The record lists no mitigations. Practical steps follow from the design review: reduce shared state between components that must stay isolated, and treat every observable side effect as part of the interface.
Quick check
Why is a covert channel hard to spot?
The system has not authorized it and has no knowledge of it, so normal controls never see it.
