systemd-dns has a remote code execution vulnerability: https://www.ubuntu.com/usn/usn-3341-1/ ← now it just needs some other bug in systemd (which surely exists given its size) and it can execute code with super-root capabilities.