Rowhammer only works by accelerating the discharge of capacitors.
Cells don't get charged by rowhammer, only discharged. The reason you may see a logical 0 change to a logical 1 is that modern DRAM memory uses a technique called scrambling, where a small 32-bit seed is used to power an LFSR stream cipher to encrypt memory. This encryption is not designed to be cryptographically secure. It is designed only to help reduce the electrical stress on a module if it experiences huge bursts of sequential 1s or 0s. The scrambling results in any physical bit having a roughly 50% chance of being represented as the inverse logical bit, so you see logical 0s become 1s.
It's not only memory scrambling which causes this disconnect between a physical bit and a logical bit. Some cells represent a logical 1 when they are charged, whereas others are the other way around. These are referred to as true-cells and anti-cells, respectively. The majority of DRAM is composed of true-cells. That is, capacitor discharge results in a 1 becoming a 0. It's only after memory scrambling, as described above, that this can result in seemingly random bitflips on the application level.
If rowhammer were capable of charging a discharged capacitor, we would be in a far worse situation than we are now. Because a DRAM refresh results in checking a capacitor's value and re-charging it if it was charged but leaving it alone if it is discharged, refresh-based mitigations can only protect from excessive rowhammer-induced discharge. Most extant mitigations currently rely on either increasing refresh rate (e.g. going from 64ms to 32ms intervals), or detecting excessive row activations and directly refreshing adjacent rows that may become unstable as a result (e.g. TRR and pTRR).note
The original paper gave three different mechanisms of action:
Electromagnetic coupling - Each capacitor has its own access transistor. When this transistor is triggered, it discharges the capacitor and reads out the value to the row buffer. Changing the voltage of one wordline can induce noise in nearby wordlines, temporarily activating access transistors on that line for short periods of time, facilitating leakage of their capacitors.
Bridge formation - Conductive channels can be formed between unrelated wires or capacitors. Toggling a wordline rapidly can increase the rate of leakage between bridged cells, resulting in charged capacitors discharging more quickly, potentially fast enough to corrupt them.
Hot-carrier injection - While this is not particularly relevant for short-term rowhammer attacks, it has been found that toggling a wordline for hundreds of hours can permanently damage it. This can alter the characteristics of access transistors and capacitors to increase leakiness.
