  Since its inception, Rowhammer exploits have rapidly evolved into
increasingly sophisticated threats not only compromising data integrity but
also the control flow integrity of victim processes. Nevertheless, it remains a
challenge for an attacker to identify vulnerable targets (i.e., Rowhammer
gadgets), understand the outcome of the attempted fault, and formulate an
attack that yields useful results.
  In this paper, we present a new type of Rowhammer gadget, called a LeapFrog
gadget, which, when present in the victim code, allows an adversary to subvert
code execution to bypass a critical piece of code (e.g., authentication check
logic, encryption rounds, padding in security protocols). The Leapfrog gadget
manifests when the victim code stores the Program Counter (PC) value in the
user or kernel stack (e.g., a return address during a function call) which,
when tampered with, re-positions the return address to a location that bypasses
a security-critical code pattern.
  This research also presents a systematic process to identify Leapfrog
gadgets. This methodology enables the automated detection of susceptible
targets and the determination of optimal attack parameters. We first showcase
this new attack vector through a practical demonstration on a TLS handshake
client/server scenario, successfully inducing an instruction skip in a client
application. We then demonstrate the attack on real-world code found in the
wild, implementing an attack on OpenSSL.
  Our findings extend the impact of Rowhammer attacks on control flow and
contribute to the development of more robust defenses against these
increasingly sophisticated threats.
