The gist of this is that a paravirtualised guest can write to arbitrary memory on the host machine under certain conditions.