One of the most interesting Windows NT kernel bugs is CVE-2015-0057 - https://blackhat.com/docs/asia-16/materials/asia-16-Wang-A-New-CVE-2015-0057-Exploit-Technology-wp.pdf The vulnerability is a use-after-free in "win32k.sys" involving "tagPROPLIST" objects. By abusing a user-mode callback at just the right moment, an attacker can force the kernel to operate on a freed object that has already been reclaimed with controlled data. The result is an arbitrary kernel read/write primitive, which is then used to replace the current process token with the SYSTEM token.
Post summary
The excerpt discloses details of CVE-2015-0057, a kernel use-after-free in win32k.sys that allows an attacker to obtain a SYSTEM token via an arbitrary kernel read/write primitive.