  A fundamental assumption in software security is that a memory location can
only be modified by processes that may write to this memory location. However,
a recent study has shown that parasitic effects in DRAM can change the content
of a memory cell without accessing it, but by accessing other memory locations
in a high frequency. This so-called Rowhammer bug occurs in most of today's
memory modules and has fatal consequences for the security of all affected
systems, e.g., privilege escalation attacks.
  All studies and attacks related to Rowhammer so far rely on the availability
of a cache flush instruction in order to cause accesses to DRAM modules at a
sufficiently high frequency. We overcome this limitation by defeating complex
cache replacement policies. We show that caches can be forced into fast cache
eviction to trigger the Rowhammer bug with only regular memory accesses. This
allows to trigger the Rowhammer bug in highly restricted and even scripting
environments.
  We demonstrate a fully automated attack that requires nothing but a website
with JavaScript to trigger faults on remote hardware. Thereby we can gain
unrestricted access to systems of website visitors. We show that the attack
works on off-the-shelf systems. Existing countermeasures fail to protect
against this new Rowhammer attack.
