The exact font used for 'serif' and 'sans-serif' depends on the browser. Most browsers will allow users to configure these settings, and (usually) default to Times New Roman (and its variants) for serifs, Arial / Helvetica for sans-serifs. Default fonts in Linux distributions vary.
If a buggy browser attempts to use a font that doesn't exist on the machine, most operating systems will degrade gracefully and use a typical system font. That's very unlikely to come into practice, though.
Because different clients and user-agents can use fonts with very different spacing and proportions, it becomes important to try and avoid using the generic 'sans-serif' and 'serif' fonts for em-based layouts.