I've been looking into rowhammer attacks and mitigations and there are two (what seem to be) mitigations that I've seen that are actually implemented in currently available hardware and software, but aren't mentioned in any studies I've seen, even recent ones, on this subject.
The first is Intel's Total Memory Encryption, which has been available since the Intel generations Ivy Bridge for servers and Alder Lake for desktops. It would seem to me that this would render rowhammer privilege escalation/remote code execution impossible (although denial of service still would be possible) as it would be impossible to predict the effects of any bit flip as all memory is encrypted with an AES-128 key that changes per boot and AES is not homomorphic, hence regardless of the fact that said encryption is transparent to software and a local attacking program could, say, determine the location of page tables and come up with a hammering pattern to flip bits to grant privilege escalation, the actual change that would occur in physical memory would, when decrypted and read by the processor, be radically different and impossible to predict.
In spite of this, I have seen no mention of memory encryption at all in any literature regarding rowhammer (including a fairly comprehensive study at https://arxiv.org/pdf/2201.02986.pdf), and the Intel page on Total Memory Encryption mentions cold boot attacks, malicious hardware attacks, and malicious hypervisor attacks but doesn't even mention rowhammer once. This would indicate to me that this is not a good defense against rowhammer, but I'm not sure how - could someone please elaborate on this matter?
The second potential defense I've seen is Windows Memory Integrity. This isn't a defense against rowhammer in general, but seems to be a defense against rowhammer attacks against page tables, which seems to be the standard method of rowhammer privilege escalation. From what I can tell, memory integrity involves maintaining shadow page tables in a hidden location via ASLR and the fact there are few, if any pointers to the page tables that could be leaked to reveal the location. Any attempt at bit flipping the page tables would therefore be detected as the change would not be present in the shadow page tables. Again though, Microsoft doesn't mention rowhammer in any documentation regarding memory integrity, which leads me to believe I might be wrong.
Are either of these defenses/mitigations effective against rowhammer?; if not - in the general sense then at the very least against privilege escalation attacks?
Also, given that DDR5 memory is now rolling out, are there any known rowhammer mitigations integrated into the hardware? I haven't heard of any, but given the attention given to hardware attacks recently it would seem strange to me that such an attack wasn't considered in a new generation of memory.