[MattSteelblade]

This type of exploit is useful as part of a chain of exploits; it defeats a defense-in-depth protection.

[twoodfin]

Specifically, it leaks a kernel address inside a security-sensitive structure, which is supposed to be unpredictable / unknowable because the layout of kernel memory is randomized.

If you have another exploit that will write bytes under the attacker’s control to an attacker-supplied kernel address, you will be able to do the Windows equivalent of escalate to root.