  The Rowhammer bug allows unauthorized modification of bits in DRAM cells from
unprivileged software, enabling powerful privilege-escalation attacks.
Sophisticated Rowhammer countermeasures have been presented, aiming at
mitigating the Rowhammer bug or its exploitation. However, the state of the art
provides insufficient insight on the completeness of these defenses. In this
paper, we present novel Rowhammer attack and exploitation primitives, showing
that even a combination of all defenses is ineffective. Our new attack
technique, one-location hammering, breaks previous assumptions on requirements
for triggering the Rowhammer bug, i.e., we do not hammer multiple DRAM rows but
only keep one DRAM row constantly open. Our new exploitation technique, opcode
flipping, bypasses recent isolation mechanisms by flipping bits in a
predictable and targeted way in userspace binaries. We replace conspicuous and
memory-exhausting spraying and grooming techniques with a novel reliable
technique called memory waylaying. Memory waylaying exploits system-level
optimizations and a side channel to coax the operating system into placing
target pages at attacker-chosen physical locations. Finally, we abuse Intel SGX
to hide the attack entirely from the user and the operating system, making any
inspection or detection of the attack infeasible. Our Rowhammer enclave can be
used for coordinated denial-of-service attacks in the cloud and for privilege
escalation on personal computers. We demonstrate that our attacks evade all
previously proposed countermeasures for commodity systems.
