QEMU PWN

https://ray-cp.github.io/archivers/qemu-pwn-basic-knowledgeray-cp.github.io

http://phrack.org/papers/vm-escape-qemu-case-study.html