On Fedora 28, which ships with GCC 8.1.1 / libstdc++ 8.1.1, the hostscan (cscan) utility that AnyConnect runs in the background after you attempt to connect encounters an error and segfaults, preventing the completion of the scan (which is what AnyConnect refers to as "CSD verification", or "posture assessment", or "pre-login verification"). This causes AnyConnect to just sit and wait without end after you enter your credentials.
Here is the error that is displayed when running the CLI client:
/builddir/build/BUILD/gcc-8.1.1-20180502/obj-x86_64-redhat-linux/x86_64-redhat-linux/libstdc++-v3/include/bits/basic_string.h:3965: std::basic_string<_CharT, _Traits, _Alloc>::reference std::basic_string<_CharT, _Traits, _Alloc>::operator[](std::basic_string<_CharT, _Traits, _Alloc>::size_type) [with _CharT = char; _Traits = std::char_traits<char>; _Alloc = std::allocator<char>; std::basic_string<_CharT, _Traits, _Alloc>::reference = char&; std::basic_string<_CharT, _Traits, _Alloc>::size_type = long unsigned int]: Assertion '__pos <= size()' failed.
Referencing https://bugzilla.redhat.com/show_bug.cgi?id=1515858 and https://fedoraproject.org/wiki/Changes/HardeningFlags28, it seems the use of'-Wp,-D_GLIBCXX_ASSERTIONS' in the compiler flags is why this is happening now in Fedora 28.
The important thing to note is that this does expose a real bug in cscan, because, as stated in the Redhat bugzilla ticket, the new compiler flags "will enable additional security hardening which performs range checking for operator[] in std::vector, std::string, and std::array." Based on the error output from cscan, it seems to be accessing an illegal string position.
I'm experiencing this on AnyConnect versions 4.3, 4.5, and 4.6 starting with Fedora 28. Fedora 27 and earlier is not affected. Please also consider that this change to Fedora will eventually make its way to Redhat Enterprise Linux (RHEL).
Update: If I copy the /lib64/libstdc++.so.6.0.24 from Fedora 27 and place it into ~/.cisco/hostscan/lib/libstdc++.so.6, then I am able to work around this issue.
