Debian Linux Security Advisory 3087-1 - Paolo Bonzini of Red Hat discovered that the blit region checks were insufficient in the Cirrus VGA emulator in qemu, a fast processor emulator. A privileged guest user could use this flaw to write into qemu address space on the host, potentially escalating their privileges to those of the qemu host process.
956182ac9fda7568c44f93e567600ed8d3ef701ad842d87e818c196f511270c4