qemu, xen-tools -- use-after-free in QEMU/Xen block unplug protocol

The Xen Project reports:

When unplugging an emulated block device the device was not fully
unplugged, meaning a second unplug attempt would attempt to unplug
the device a second time using a previously freed pointer.
An HVM guest which has access to an emulated IDE disk device may be
able to exploit this vulnerability in order to take over the qemu
process elevating its privilege to that of the qemu process.