Mehdi Talbi and I have published a case study of VM escape on Phrack. The full paper is available at http://phrack.org/papers/vm-escape-qemu-case-study.html.