klif.sys driver removes supervisor memory protection bit. It's code can be modified from user space application and to be executed in kernel mode.
vulners.com/securityvulns/securityvulns:doc:8794
vulners.com/securityvulns/securityvulns:doc:8813