The vmware-vga driver (hw/display/vmware_vga.c) in QEMU allows local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3689