This is a write up detailing how abusing enabled token privileges through a kernel exploit to gain elevation of privilege won’t be enough anymore. From NT kernel version 10.0.15063 they are checked against the privileges present in the token of the calling process so an attacker needs to use two writes.
You can download it from the following link: https://packetstormsecurity.com/files/download/142256/ntoskrnl.pdf
Source: https://packetstormsecurity.com/files/142256/nt-_SEP_TOKEN_PRIVILEGES-Single-Write-EoP-Protection.html