What are the security implications if systemd is not restarted after it has been updated?

Question

My understanding is that systemd is the parent process for all other processes running on Linux.

If systemd has been updated on production devices such as servers and the service is not restarted, what are the security implications?

What are the common attack vectors for systemd to signal it must be restarted?

The article on systemctl daemon-reexec suggests that a package update already performs restart systemd.

This suggests there is no requirement to restart systemd even though the output below displays it has been updated and may be using deleted files.

PID  | PPID | UID  | User    | Command       | Service       | Files                      
-----+------+------+---------+---------------+---------------+----------------------------
1    | 0    | 0    | root    | systemd       |               | /usr/lib64/libkmod.so.2.3.3
907  | 1    | 0    | root    | systemd-udevd | systemd-udevd | /usr/lib64/libkmod.so.2.3.3
2284 | 1    | 1000 | user    | systemd       |               | /usr/lib64/libkmod.so.2.3.3
2285 | 2284 | 1000 | user    | systemd       |               | /usr/lib64/libkmod.so.2.3.3

Answer 1

It's still running the old binary, having all its vulnerabilities. You can restart Systemd without reboot using the Manager Lifecycle Commands: systemctl daemon-reexec should be enough after a package upgrade.

The details depends entirely on the vulnerabilities found in the specific version and is information that will become obsolete too quickly to be meaningful on a Q/A site. You should check

• the release notes (for Ubuntu, Debian e.g. stable systemd_232-25+deb9u8) and

• Common Vulnerabilities and Exposures (CVE). Last vulnerabilities were memory corruptions (CVE-2018-16864, CVE-2018-16865) and an information leak (CVE-2018-16866). (You could also notice that there's CVE-2018-16888 that hasn't currently been fixed in Debian stable.)

If you aren't able to evaluate whether these vulnerabilities have security implications in your situation, just upgrade your packages regularly and restart the services.