Hmm, it seems that all the pieces aren't in place yet. If I'm understanding correctly, the exploit technique they use relies on cross-page errors (causing errors in one page with accesses to another page), because the page with errors needs to get freed to the operating system to potentially reuse as PTEs, while still having the ability to cause the errors. There's a line on one of the slides that says you can use timing information to get cross-page information, but I'm really not sure what that means, and how feasible it is.

In addition, they need to find a double-bit error, one that would change both the writable bit and an address bit, if a PTE was in that place in memory. They mentioned that they tested their laptop for these errors, and they're possible, but much rarer--how rare? This point was kind of just glossed over.

I'd guess that these two combined would make an exploitable error much more unlikely.