Toolchain directive in go.mod not being considered

[mattjohnsonpint]

Consider a project with a go.mod file as follows:

module example

go 1.23.5

toolchain go1.23.6

According to the docs for Go Toolchains:

Starting in Go 1.21, the Go distribution consists of a go command and a bundled Go toolchain, which is the standard library as well as the compiler, assembler, and other tools.

Since the standard library is part of the toolchain, then as long as Go 1.23.6 is installed, Go will use stdlib from Go 1.23.6 with this configuration.

However, OSV-Scanner reports:

Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec. Current version of 'stdlib' is vulnerable: 1.23.5. osv-scanner/CVE-2025-22866

... which was one of the issues fixed in Go 1.23.6.

I conclude that the toolchain directive is not being honored. Is that correct?

[mattjohnsonpint]

That output was using osv-scanner via a Trunk plugin. Here's the same using osv-scanner 1.9.2 directly:

╭──────────────────────────────┬──────┬───────────┬─────────┬─────────┬────────╮
│ OSV URL                      │ CVSS │ ECOSYSTEM │ PACKAGE │ VERSION │ SOURCE │
├──────────────────────────────┼──────┼───────────┼─────────┼─────────┼────────┤
│ Uncalled vulnerabilities     │      │           │         │         │        │
├──────────────────────────────┼──────┼───────────┼─────────┼─────────┼────────┤
│ https://osv.dev/GO-2025-3447 │      │ Go        │ stdlib  │ 1.23.5  │ go.mod │
╰──────────────────────────────┴──────┴───────────┴─────────┴─────────┴────────╯

Full output with osv-scanner scan --json .:

{
  "results": [
    {
      "source": {
        "path": "/Users/matt/temp/example/go.mod",
        "type": "lockfile"
      },
      "packages": [
        {
          "package": {
            "name": "stdlib",
            "version": "1.23.5",
            "ecosystem": "Go"
          },
          "vulnerabilities": [
            {
              "modified": "2025-02-08T08:11:54Z",
              "published": "2025-02-06T16:38:14Z",
              "schema_version": "1.6.0",
              "id": "GO-2025-3447",
              "aliases": [
                "BIT-golang-2025-22866",
                "CVE-2025-22866"
              ],
              "summary": "Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec",
              "details": "Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Due to the way this function is used, we do not believe this leakage is enough to allow recovery of the private key when P-256 is used in any well known protocols.",
              "affected": [
                {
                  "package": {
                    "ecosystem": "Go",
                    "name": "stdlib",
                    "purl": "pkg:golang/stdlib"
                  },
                  "ranges": [
                    {
                      "type": "SEMVER",
                      "events": [
                        {
                          "introduced": "0"
                        },
                        {
                          "fixed": "1.22.12"
                        },
                        {
                          "introduced": "1.23.0-0"
                        },
                        {
                          "fixed": "1.23.6"
                        },
                        {
                          "introduced": "1.24.0-0"
                        },
                        {
                          "fixed": "1.24.0-rc.3"
                        }
                      ]
                    }
                  ],
                  "database_specific": {
                    "source": "https://vuln.go.dev/ID/GO-2025-3447.json"
                  },
                  "ecosystem_specific": {
                    "imports": [
                      {
                        "goarch": [
                          "ppc64le"
                        ],
                        "path": "crypto/internal/nistec",
                        "symbols": [
                          "P256Point.ScalarBaseMult",
                          "P256Point.ScalarMult",
                          "P256Point.SetBytes",
                          "p256NegCond"
                        ]
                      }
                    ]
                  }
                }
              ],
              "references": [
                {
                  "type": "FIX",
                  "url": "https://go.dev/cl/643735"
                },
                {
                  "type": "REPORT",
                  "url": "https://go.dev/issue/71383"
                },
                {
                  "type": "WEB",
                  "url": "https://groups.google.com/g/golang-announce/c/xU1ZCHUZw3k"
                }
              ],
              "database_specific": {
                "review_status": "REVIEWED",
                "url": "https://pkg.go.dev/vuln/GO-2025-3447"
              }
            }
          ],
          "groups": [
            {
              "ids": [
                "GO-2025-3447"
              ],
              "aliases": [
                "BIT-golang-2025-22866",
                "CVE-2025-22866",
                "GO-2025-3447"
              ],
              "experimentalAnalysis": {
                "GO-2025-3447": {
                  "called": false,
                  "unimportant": false
                }
              },
              "max_severity": ""
            }
          ]
        }
      ]
    }
  ],
  "experimental_config": {
    "licenses": {
      "summary": false,
      "allowlist": null
    }
  }
}

[mattjohnsonpint]

Aside - since the vuln is ecosystem_specific for ppc64le is there a convenient way to indicate that I don't target that platform, to avoid raising this at all?